drc: ignore cache-through on smc check
[picodrive.git] / cpu / sh2 / compiler.c
index 6f08e7b..0e8b65b 100644 (file)
@@ -1,13 +1,15 @@
 /*
- * vim:shiftwidth=2:expandtab
+ * SH2 recompiler
+ * (C) notaz, 2009,2010,2013
+ *
+ * This work is licensed under the terms of MAME license.
+ * See COPYING file in the top-level directory.
  *
  * notes:
  * - tcache, block descriptor, link buffer overflows result in sh2_translate()
  *   failure, followed by full tcache invalidation for that region
- * - jumps between blocks are tracked for SMC handling (in block_links[]),
+ * - jumps between blocks are tracked for SMC handling (in block_entry->links),
  *   except jumps between different tcaches
- * - non-main block entries are called subblocks, as they have same tracking
- *   structures that main blocks have.
  *
  * implemented:
  * - static register allocation
 #define LINK_BRANCHES           1
 
 // limits (per block)
-#define BLOCK_CYCLE_LIMIT       100
-#define MAX_BLOCK_SIZE          (BLOCK_CYCLE_LIMIT * 6 * 6)
+#define MAX_BLOCK_SIZE          (BLOCK_INSN_LIMIT * 6 * 6)
 
 // max literal offset from the block end
 #define MAX_LITERAL_OFFSET      32*2
-#define MAX_LITERALS            (BLOCK_CYCLE_LIMIT / 4)
+#define MAX_LITERALS            (BLOCK_INSN_LIMIT / 4)
 #define MAX_LOCAL_BRANCHES      32
 
-// debug stuff {
+// debug stuff
+// 01 - warnings/errors
+// 02 - block info/smc
+// 04 - asm
+// 08 - runtime block entry log
+// 10 - smc self-check
+// {
 #ifndef DRC_DEBUG
 #define DRC_DEBUG 0
 #endif
@@ -55,9 +62,8 @@
   if ((l) & DRC_DEBUG) \
     elprintf(EL_STATUS, ##__VA_ARGS__); \
 }
-
 #include "mame/sh2dasm.h"
-#include <platform/linux/host_dasm.h>
+#include <platform/libpicofe/linux/host_dasm.h>
 static int insns_compiled, hash_collisions, host_insn_count;
 #define COUNT_OP \
        host_insn_count++
@@ -66,6 +72,64 @@ static int insns_compiled, hash_collisions, host_insn_count;
 #define dbg(...)
 #endif
 
+///
+#define FETCH_OP(pc) \
+  dr_pc_base[(pc) / 2]
+
+#define FETCH32(a) \
+  ((dr_pc_base[(a) / 2] << 16) | dr_pc_base[(a) / 2 + 1])
+
+#define CHECK_UNHANDLED_BITS(mask, label) { \
+  if ((op & (mask)) != 0) \
+    goto label; \
+}
+
+#define GET_Fx() \
+  ((op >> 4) & 0x0f)
+
+#define GET_Rm GET_Fx
+
+#define GET_Rn() \
+  ((op >> 8) & 0x0f)
+
+#define BITMASK1(v0) (1 << (v0))
+#define BITMASK2(v0,v1) ((1 << (v0)) | (1 << (v1)))
+#define BITMASK3(v0,v1,v2) (BITMASK2(v0,v1) | (1 << (v2)))
+#define BITMASK4(v0,v1,v2,v3) (BITMASK3(v0,v1,v2) | (1 << (v3)))
+#define BITMASK5(v0,v1,v2,v3,v4) (BITMASK4(v0,v1,v2,v3) | (1 << (v4)))
+
+#define SHR_T SHR_SR // might make them separate someday
+
+static struct op_data {
+  u8 op;
+  u8 cycles;
+  u8 size;     // 0, 1, 2 - byte, word, long
+  s8 rm;       // branch or load/store data reg
+  u32 source;  // bitmask of src regs
+  u32 dest;    // bitmask of dest regs
+  u32 imm;     // immediate/io address/branch target
+               // (for literal - address, not value)
+} ops[BLOCK_INSN_LIMIT];
+
+enum op_types {
+  OP_UNHANDLED = 0,
+  OP_BRANCH,
+  OP_BRANCH_CT, // conditional, branch if T set
+  OP_BRANCH_CF, // conditional, branch if T clear
+  OP_BRANCH_R,  // indirect
+  OP_BRANCH_RF, // indirect far (PC + Rm)
+  OP_SETCLRT,   // T flag set/clear
+  OP_MOVE,      // register move
+  OP_LOAD_POOL, // literal pool load, imm is address
+  OP_MOVA,
+  OP_SLEEP,
+  OP_RTE,
+};
+
+#ifdef DRC_SH2
+
+static int literal_disabled_frames;
+
 #if (DRC_DEBUG & 4)
 static u8 *tcache_dsm_ptrs[3];
 static char sh2dasm_buff[64];
@@ -96,7 +160,7 @@ static void REGPARM(3) *sh2_drc_log_entry(void *block, SH2 *sh2, u32 sr)
 // and can be discarded early
 // XXX: need to tune sizes
 static const int tcache_sizes[TCACHE_BUFFERS] = {
-  DRC_TCACHE_SIZE * 6 / 8, // ROM, DRAM
+  DRC_TCACHE_SIZE * 6 / 8, // ROM (rarely used), DRAM
   DRC_TCACHE_SIZE / 8, // BIOS, data array in master sh2
   DRC_TCACHE_SIZE / 8, // ... slave
 };
@@ -107,30 +171,79 @@ static u8 *tcache_ptrs[TCACHE_BUFFERS];
 // ptr for code emiters
 static u8 *tcache_ptr;
 
-typedef struct block_desc_ {
-  u32 addr;                  // SH2 PC address
+#define MAX_BLOCK_ENTRIES (BLOCK_INSN_LIMIT / 8)
+
+struct block_link {
+  u32 target_pc;
+  void *jump;                // insn address
+  struct block_link *next;   // either in block_entry->links or 
+};
+
+struct block_entry {
+  u32 pc;
   void *tcache_ptr;          // translated block for above PC
-  struct block_desc_ *next;  // next block with the same PC hash
+  struct block_entry *next;  // next block in hash_table with same pc hash
+  struct block_link *links;  // links to this entry
 #if (DRC_DEBUG & 2)
-  int refcount;
+  struct block_desc *block;
 #endif
-} block_desc;
+};
 
-typedef struct block_link_ {
-  u32 target_pc;
-  void *jump;     // insn address
-//  struct block_link_ *next;
-} block_link;
+struct block_desc {
+  u32 addr;                  // block start SH2 PC address
+  u16 size;                  // ..of recompiled insns+lit. pool
+  u16 size_nolit;            // same without literals
+#if (DRC_DEBUG & 2)
+  int refcount;
+#endif
+  int entry_count;
+  struct block_entry entryp[MAX_BLOCK_ENTRIES];
+};
 
 static const int block_max_counts[TCACHE_BUFFERS] = {
   4*1024,
   256,
   256,
 };
-static block_desc *block_tables[TCACHE_BUFFERS];
-static block_link *block_links[TCACHE_BUFFERS]; 
+static struct block_desc *block_tables[TCACHE_BUFFERS];
 static int block_counts[TCACHE_BUFFERS];
-static int block_link_counts[TCACHE_BUFFERS];
+
+// we have block_link_pool to avoid using mallocs
+static const int block_link_pool_max_counts[TCACHE_BUFFERS] = {
+  4*1024,
+  256,
+  256,
+};
+static struct block_link *block_link_pool[TCACHE_BUFFERS]; 
+static int block_link_pool_counts[TCACHE_BUFFERS];
+static struct block_link *unresolved_links[TCACHE_BUFFERS];
+
+// used for invalidation
+static const int ram_sizes[TCACHE_BUFFERS] = {
+  0x40000,
+  0x1000,
+  0x1000,
+};
+#define INVAL_PAGE_SIZE 0x100
+
+struct block_list {
+  struct block_desc *block;
+  struct block_list *next;
+};
+
+// array of pointers to block_lists for RAM and 2 data arrays
+// each array has len: sizeof(mem) / INVAL_PAGE_SIZE 
+static struct block_list **inval_lookup[TCACHE_BUFFERS];
+
+static const int hash_table_sizes[TCACHE_BUFFERS] = {
+  0x1000,
+  0x100,
+  0x100,
+};
+static struct block_entry **hash_tables[TCACHE_BUFFERS];
+
+#define HASH_FUNC(hash_tab, addr, mask) \
+  (hash_tab)[(((addr) >> 20) ^ ((addr) >> 2)) & (mask)]
 
 // host register tracking
 enum {
@@ -155,18 +268,34 @@ typedef struct {
 
 // note: reg_temp[] must have at least the amount of
 // registers used by handlers in worst case (currently 4)
-#ifdef ARM
+#ifdef __arm__
 #include "../drc/emit_arm.c"
 
+#ifndef __MACH__
+
 static const int reg_map_g2h[] = {
    4,  5,  6,  7,
    8, -1, -1, -1,
   -1, -1, -1, -1,
-  -1, -1, -1,  9,
-  -1, -1, -1, 10,
+  -1, -1, -1,  9, // r12 .. sp
+  -1, -1, -1, 10, // SHR_PC,  SHR_PPC, SHR_PR,   SHR_SR,
+  -1, -1, -1, -1, // SHR_GBR, SHR_VBR, SHR_MACH, SHR_MACL,
+};
+
+#else
+
+// no r9..
+static const int reg_map_g2h[] = {
+   4,  5,  6,  7,
+  -1, -1, -1, -1,
   -1, -1, -1, -1,
+  -1, -1, -1,  8, // r12 .. sp
+  -1, -1, -1, 10, // SHR_PC,  SHR_PPC, SHR_PR,   SHR_SR,
+  -1, -1, -1, -1, // SHR_GBR, SHR_VBR, SHR_MACH, SHR_MACL,
 };
 
+#endif
+
 static temp_reg_t reg_temp[] = {
   {  0, },
   {  1, },
@@ -211,14 +340,6 @@ static temp_reg_t reg_temp[] = {
 #define Q_SHIFT 8
 #define M_SHIFT 9
 
-// ROM hash table
-#define MAX_HASH_ENTRIES 1024
-#define HASH_MASK (MAX_HASH_ENTRIES - 1)
-static void **hash_table;
-
-#define HASH_FUNC(hash_tab, addr) \
-  ((block_desc **)(hash_tab))[(addr) & HASH_MASK]
-
 static void REGPARM(1) (*sh2_drc_entry)(SH2 *sh2);
 static void            (*sh2_drc_dispatcher)(void);
 static void            (*sh2_drc_exit)(void);
@@ -228,46 +349,10 @@ static u32  REGPARM(2) (*sh2_drc_read8)(u32 a, SH2 *sh2);
 static u32  REGPARM(2) (*sh2_drc_read16)(u32 a, SH2 *sh2);
 static u32  REGPARM(2) (*sh2_drc_read32)(u32 a, SH2 *sh2);
 static void REGPARM(2) (*sh2_drc_write8)(u32 a, u32 d);
-static void REGPARM(2) (*sh2_drc_write8_slot)(u32 a, u32 d);
 static void REGPARM(2) (*sh2_drc_write16)(u32 a, u32 d);
-static void REGPARM(2) (*sh2_drc_write16_slot)(u32 a, u32 d);
-static int  REGPARM(3) (*sh2_drc_write32)(u32 a, u32 d, SH2 *sh2);
-
-extern void REGPARM(2) sh2_do_op(SH2 *sh2, int opcode);
+static void REGPARM(3) (*sh2_drc_write32)(u32 a, u32 d, SH2 *sh2);
 
 // address space stuff
-static void *dr_get_pc_base(u32 pc, int is_slave)
-{
-  void *ret = NULL;
-  u32 mask = 0;
-
-  if ((pc & ~0x7ff) == 0) {
-    // BIOS
-    ret = is_slave ? Pico32xMem->sh2_rom_s : Pico32xMem->sh2_rom_m;
-    mask = 0x7ff;
-  }
-  else if ((pc & 0xfffff000) == 0xc0000000) {
-    // data array
-    ret = Pico32xMem->data_array[is_slave];
-    mask = 0xfff;
-  }
-  else if ((pc & 0xc6000000) == 0x06000000) {
-    // SDRAM
-    ret = Pico32xMem->sdram;
-    mask = 0x03ffff;
-  }
-  else if ((pc & 0xc6000000) == 0x02000000) {
-    // ROM
-    ret = Pico.rom;
-    mask = 0x3fffff;
-  }
-
-  if (ret == NULL)
-    return (void *)-1; // NULL is valid value
-
-  return (char *)ret - (pc & ~mask);
-}
-
 static int dr_ctx_get_mem_ptr(u32 a, u32 *mask)
 {
   int poffs = -1;
@@ -279,6 +364,7 @@ static int dr_ctx_get_mem_ptr(u32 a, u32 *mask)
   }
   else if ((a & 0xfffff000) == 0xc0000000) {
     // data array
+    // FIXME: access sh2->data_array instead
     poffs = offsetof(SH2, p_da);
     *mask = 0xfff;
   }
@@ -296,32 +382,22 @@ static int dr_ctx_get_mem_ptr(u32 a, u32 *mask)
   return poffs;
 }
 
-static block_desc *dr_get_bd(u32 pc, int is_slave, int *tcache_id)
+static struct block_entry *dr_get_entry(u32 pc, int is_slave, int *tcache_id)
 {
-  *tcache_id = 0;
+  struct block_entry *be;
+  u32 tcid = 0, mask;
 
-  // we have full block id tables for data_array and RAM
-  // BIOS goes to data_array table too
-  if ((pc & 0xe0000000) == 0xc0000000 || (pc & ~0xfff) == 0) {
-    int blkid = Pico32xMem->drcblk_da[is_slave][(pc & 0xfff) >> SH2_DRCBLK_DA_SHIFT];
-    *tcache_id = 1 + is_slave;
-    if (blkid & 1)
-      return &block_tables[*tcache_id][blkid >> 1];
-  }
-  // RAM
-  else if ((pc & 0xc6000000) == 0x06000000) {
-    int blkid = Pico32xMem->drcblk_ram[(pc & 0x3ffff) >> SH2_DRCBLK_RAM_SHIFT];
-    if (blkid & 1)
-      return &block_tables[0][blkid >> 1];
-  }
-  // ROM
-  else if ((pc & 0xc6000000) == 0x02000000) {
-    block_desc *bd = HASH_FUNC(hash_table, pc);
+  // data arrays have their own caches
+  if ((pc & 0xe0000000) == 0xc0000000 || (pc & ~0xfff) == 0)
+    tcid = 1 + is_slave;
 
-    for (; bd != NULL; bd = bd->next)
-      if (bd->addr == pc)
-        return bd;
-  }
+  *tcache_id = tcid;
+
+  mask = hash_table_sizes[tcid] - 1;
+  be = HASH_FUNC(hash_tables[tcid], pc, mask);
+  for (; be != NULL; be = be->next)
+    if (be->pc == pc)
+      return be;
 
   return NULL;
 }
@@ -329,58 +405,153 @@ static block_desc *dr_get_bd(u32 pc, int is_slave, int *tcache_id)
 // ---------------------------------------------------------------
 
 // block management
+static void add_to_block_list(struct block_list **blist, struct block_desc *block)
+{
+  struct block_list *added = malloc(sizeof(*added));
+  if (!added) {
+    elprintf(EL_ANOMALY, "drc OOM (1)");
+    return;
+  }
+  added->block = block;
+  added->next = *blist;
+  *blist = added;
+}
+
+static void rm_from_block_list(struct block_list **blist, struct block_desc *block)
+{
+  struct block_list *prev = NULL, *current = *blist;
+  for (; current != NULL; current = current->next) {
+    if (current->block == block) {
+      if (prev == NULL)
+        *blist = current->next;
+      else
+        prev->next = current->next;
+      free(current);
+      return;
+    }
+    prev = current;
+  }
+  dbg(1, "can't rm block %p (%08x-%08x)",
+    block, block->addr, block->addr + block->size);
+}
+
+static void rm_block_list(struct block_list **blist)
+{
+  struct block_list *tmp, *current = *blist;
+  while (current != NULL) {
+    tmp = current;
+    current = current->next;
+    free(tmp);
+  }
+  *blist = NULL;
+}
+
 static void REGPARM(1) flush_tcache(int tcid)
 {
+  int i;
+
   dbg(1, "tcache #%d flush! (%d/%d, bds %d/%d)", tcid,
     tcache_ptrs[tcid] - tcache_bases[tcid], tcache_sizes[tcid],
     block_counts[tcid], block_max_counts[tcid]);
 
   block_counts[tcid] = 0;
-  block_link_counts[tcid] = 0;
+  block_link_pool_counts[tcid] = 0;
+  unresolved_links[tcid] = NULL;
+  memset(hash_tables[tcid], 0, sizeof(*hash_tables[0]) * hash_table_sizes[tcid]);
   tcache_ptrs[tcid] = tcache_bases[tcid];
-  if (tcid == 0) { // ROM, RAM
-    memset(hash_table, 0, sizeof(hash_table[0]) * MAX_HASH_ENTRIES);
-    memset(Pico32xMem->drcblk_ram, 0, sizeof(Pico32xMem->drcblk_ram));
+  if (Pico32xMem != NULL) {
+    if (tcid == 0) // ROM, RAM
+      memset(Pico32xMem->drcblk_ram, 0,
+             sizeof(Pico32xMem->drcblk_ram));
+    else
+      memset(Pico32xMem->drcblk_da[tcid - 1], 0,
+             sizeof(Pico32xMem->drcblk_da[0]));
   }
-  else
-    memset(Pico32xMem->drcblk_da[tcid - 1], 0, sizeof(Pico32xMem->drcblk_da[0]));
 #if (DRC_DEBUG & 4)
   tcache_dsm_ptrs[tcid] = tcache_bases[tcid];
 #endif
+
+  for (i = 0; i < ram_sizes[tcid] / INVAL_PAGE_SIZE; i++)
+    rm_block_list(&inval_lookup[tcid][i]);
 }
 
-#if LINK_BRANCHES
-// add block links (tracked branches)
-static int dr_add_block_link(u32 target_pc, void *jump, int tcache_id)
+static void add_to_hashlist(struct block_entry *be, int tcache_id)
 {
-  block_link *bl = block_links[tcache_id];
-  int cnt = block_link_counts[tcache_id];
+  u32 tcmask = hash_table_sizes[tcache_id] - 1;
 
-  if (cnt >= block_max_counts[tcache_id] * 2) {
-    dbg(1, "bl overflow for tcache %d\n", tcache_id);
-    return -1;
+  be->next = HASH_FUNC(hash_tables[tcache_id], be->pc, tcmask);
+  HASH_FUNC(hash_tables[tcache_id], be->pc, tcmask) = be;
+
+#if (DRC_DEBUG & 2)
+  if (be->next != NULL) {
+    printf(" %08x: hash collision with %08x\n",
+      be->pc, be->next->pc);
+    hash_collisions++;
+  }
+#endif
+}
+
+static void rm_from_hashlist(struct block_entry *be, int tcache_id)
+{
+  u32 tcmask = hash_table_sizes[tcache_id] - 1;
+  struct block_entry *cur, *prev;
+  
+  cur = HASH_FUNC(hash_tables[tcache_id], be->pc, tcmask);
+  if (cur == NULL)
+    goto missing;
+
+  if (be == cur) { // first
+    HASH_FUNC(hash_tables[tcache_id], be->pc, tcmask) = be->next;
+    return;
   }
 
-  bl[cnt].target_pc = target_pc;
-  bl[cnt].jump = jump;
-  block_link_counts[tcache_id]++;
+  for (prev = cur, cur = cur->next; cur != NULL; cur = cur->next) {
+    if (cur == be) {
+      prev->next = cur->next;
+      return;
+    }
+  }
 
-  return 0;
+missing:
+  dbg(1, "rm_from_hashlist: be %p %08x missing?", be, be->pc);
 }
-#endif
 
-static block_desc *dr_add_block(u32 addr, int is_slave, int *blk_id)
+static void unregister_links(struct block_entry *be, int tcache_id)
 {
-  block_desc *bd;
+  struct block_link *bl_unresolved = unresolved_links[tcache_id];
+  struct block_link *bl, *bl_next;
+
+  for (bl = be->links; bl != NULL; ) {
+    bl_next = bl->next;
+    bl->next = bl_unresolved;
+    bl_unresolved = bl;
+    bl = bl_next;
+  }
+  be->links = NULL;
+  unresolved_links[tcache_id] = bl_unresolved;
+}
+
+// unlike sh2_smc_rm_block, the block stays and can still be accessed
+// by other already directly linked blocks, just not preferred
+static void kill_block_entry(struct block_entry *be, int tcache_id)
+{
+  rm_from_hashlist(be, tcache_id);
+  unregister_links(be, tcache_id);
+}
+
+static struct block_desc *dr_add_block(u32 addr, u16 size_lit,
+  u16 size_nolit, int is_slave, int *blk_id)
+{
+  struct block_entry *be;
+  struct block_desc *bd;
   int tcache_id;
   int *bcount;
 
-  bd = dr_get_bd(addr, is_slave, &tcache_id);
-  if (bd != NULL) {
-    dbg(2, "block override for %08x", addr);
-    bd->tcache_ptr = tcache_ptr;
-    *blk_id = bd - block_tables[tcache_id];
-    return bd;
+  // do a lookup to get tcache_id and override check
+  be = dr_get_entry(addr, is_slave, &tcache_id);
+  if (be != NULL) {
+    dbg(1, "block override for %08x, was %p", addr, be->tcache_ptr);
+    kill_block_entry(be, tcache_id);
   }
 
   bcount = &block_counts[tcache_id];
@@ -388,91 +559,132 @@ static block_desc *dr_add_block(u32 addr, int is_slave, int *blk_id)
     dbg(1, "bd overflow for tcache %d", tcache_id);
     return NULL;
   }
-  if (*bcount == 0)
-    (*bcount)++; // not using descriptor 0
 
   bd = &block_tables[tcache_id][*bcount];
   bd->addr = addr;
-  bd->tcache_ptr = tcache_ptr;
-  *blk_id = *bcount;
-  (*bcount)++;
+  bd->size = size_lit;
+  bd->size_nolit = size_nolit;
 
-  if ((addr & 0xc6000000) == 0x02000000) { // ROM
-    bd->next = HASH_FUNC(hash_table, addr);
-    HASH_FUNC(hash_table, addr) = bd;
+  bd->entry_count = 1;
+  bd->entryp[0].pc = addr;
+  bd->entryp[0].tcache_ptr = tcache_ptr;
+  bd->entryp[0].links = NULL;
 #if (DRC_DEBUG & 2)
-    if (bd->next != NULL) {
-      printf(" hash collision with %08x\n", bd->next->addr);
-      hash_collisions++;
-    }
+  bd->entryp[0].block = bd;
+  bd->refcount = 0;
 #endif
-  }
+  add_to_hashlist(&bd->entryp[0], tcache_id);
+
+  *blk_id = *bcount;
+  (*bcount)++;
 
   return bd;
 }
 
 static void REGPARM(3) *dr_lookup_block(u32 pc, int is_slave, int *tcache_id)
 {
-  block_desc *bd = NULL;
+  struct block_entry *be = NULL;
   void *block = NULL;
 
-  bd = dr_get_bd(pc, is_slave, tcache_id);
-  if (bd != NULL)
-    block = bd->tcache_ptr;
+  be = dr_get_entry(pc, is_slave, tcache_id);
+  if (be != NULL)
+    block = be->tcache_ptr;
 
 #if (DRC_DEBUG & 2)
-  if (bd != NULL)
-    bd->refcount++;
+  if (be != NULL)
+    be->block->refcount++;
 #endif
   return block;
 }
 
-static void *dr_prepare_ext_branch(u32 pc, SH2 *sh2, int tcache_id)
+static void *dr_failure(void)
+{
+  lprintf("recompilation failed\n");
+  exit(1);
+}
+
+static void *dr_prepare_ext_branch(u32 pc, int is_slave, int tcache_id)
 {
 #if LINK_BRANCHES
+  struct block_link *bl = block_link_pool[tcache_id];
+  int cnt = block_link_pool_counts[tcache_id];
+  struct block_entry *be = NULL;
   int target_tcache_id;
-  void *target;
-  int ret;
-
-  target = dr_lookup_block(pc, sh2->is_slave, &target_tcache_id);
-  if (target_tcache_id == tcache_id) {
-    // allow linking blocks only from local cache
-    ret = dr_add_block_link(pc, tcache_ptr, tcache_id);
-    if (ret < 0)
-      return NULL;
+  int i;
+
+  be = dr_get_entry(pc, is_slave, &target_tcache_id);
+  if (target_tcache_id != tcache_id)
+    return sh2_drc_dispatcher;
+
+  // if pool has been freed, reuse
+  for (i = cnt - 1; i >= 0; i--)
+    if (bl[i].target_pc != 0)
+      break;
+  cnt = i + 1;
+  if (cnt >= block_link_pool_max_counts[tcache_id]) {
+    dbg(1, "bl overflow for tcache %d", tcache_id);
+    return NULL;
   }
-  if (target == NULL || target_tcache_id != tcache_id)
-    target = sh2_drc_dispatcher;
+  bl += cnt;
+  block_link_pool_counts[tcache_id]++;
+
+  bl->target_pc = pc;
+  bl->jump = tcache_ptr;
 
-  return target;
+  if (be != NULL) {
+    dbg(2, "- early link from %p to pc %08x", bl->jump, pc);
+    bl->next = be->links;
+    be->links = bl;
+    return be->tcache_ptr;
+  }
+  else {
+    bl->next = unresolved_links[tcache_id];
+    unresolved_links[tcache_id] = bl;
+    return sh2_drc_dispatcher;
+  }
 #else
   return sh2_drc_dispatcher;
 #endif
 }
 
-static void dr_link_blocks(void *target, u32 pc, int tcache_id)
+static void dr_link_blocks(struct block_entry *be, int tcache_id)
 {
 #if LINK_BRANCHES
-  block_link *bl = block_links[tcache_id];
-  int cnt = block_link_counts[tcache_id];
-  int i;
-
-  for (i = 0; i < cnt; i++) {
-    if (bl[i].target_pc == pc) {
-      dbg(2, "- link from %p", bl[i].jump);
-      emith_jump_patch(bl[i].jump, target);
-      // XXX: sync ARM caches (old jump should be fine)?
+  struct block_link *first = unresolved_links[tcache_id];
+  struct block_link *bl, *prev, *tmp;
+  u32 pc = be->pc;
+
+  for (bl = prev = first; bl != NULL; ) {
+    if (bl->target_pc == pc) {
+      dbg(2, "- link from %p to pc %08x", bl->jump, pc);
+      emith_jump_patch(bl->jump, tcache_ptr);
+
+      // move bl from unresolved_links to block_entry
+      tmp = bl->next;
+      bl->next = be->links;
+      be->links = bl;
+
+      if (bl == first)
+        first = prev = bl = tmp;
+      else
+        prev->next = bl = tmp;
+      continue;
     }
+    prev = bl;
+    bl = bl->next;
   }
+  unresolved_links[tcache_id] = first;
+
+  // could sync arm caches here, but that's unnecessary
 #endif
 }
 
 #define ADD_TO_ARRAY(array, count, item, failcode) \
-  array[count++] = item; \
   if (count >= ARRAY_SIZE(array)) { \
     dbg(1, "warning: " #array " overflow"); \
     failcode; \
-  }
+  } \
+  array[count++] = item;
 
 static int find_in_array(u32 *array, size_t size, u32 what)
 {
@@ -832,6 +1044,20 @@ static void rcache_unlock_all(void)
     reg_temp[i].flags &= ~HRF_LOCKED;
 }
 
+#ifdef DRC_CMP
+static u32 rcache_used_hreg_mask(void)
+{
+  u32 mask = 0;
+  int i;
+
+  for (i = 0; i < ARRAY_SIZE(reg_temp); i++)
+    if (reg_temp[i].type != HR_FREE)
+      mask |= 1 << reg_temp[i].hreg;
+
+  return mask;
+}
+#endif
+
 static void rcache_clean(void)
 {
   int i;
@@ -913,8 +1139,11 @@ static void emit_or_t_if_eq(int srr)
 // reg cache must be clean before call
 static int emit_memhandler_read_(int size, int ram_check)
 {
-  int arg0, arg1;
+  int arg1;
+#if 0
+  int arg0;
   host_arg2reg(arg0, 0);
+#endif
 
   rcache_clean();
 
@@ -926,7 +1155,8 @@ static int emit_memhandler_read_(int size, int ram_check)
   arg1 = rcache_get_tmp_arg(1);
   emith_move_r_r(arg1, CONTEXT_REG);
 
-#ifndef PDB_NET
+#if 0 // can't do this because of unmapped reads
+ // ndef PDB_NET
   if (ram_check && Pico.rom == (void *)0x02000000 && Pico32xMem->sdram == (void *)0x06000000) {
     int tmp = rcache_get_tmp();
     emith_and_r_r_imm(tmp, arg0, 0xfb000000);
@@ -973,6 +1203,10 @@ static int emit_memhandler_read_(int size, int ram_check)
     }
   }
   rcache_invalidate();
+
+  if (reg_map_g2h[SHR_SR] != -1)
+    emith_ctx_read(reg_map_g2h[SHR_SR], SHR_SR * 4);
+
   // assuming arg0 and retval reg matches
   return rcache_get_tmp_arg(0);
 }
@@ -1026,36 +1260,32 @@ static int emit_memhandler_read_rr(sh2_reg_e rd, sh2_reg_e rs, u32 offs, int siz
   return hr2;
 }
 
-static void emit_memhandler_write(int size, u32 pc, int delay)
+static void emit_memhandler_write(int size)
 {
   int ctxr;
   host_arg2reg(ctxr, 2);
+  if (reg_map_g2h[SHR_SR] != -1)
+    emith_ctx_write(reg_map_g2h[SHR_SR], SHR_SR * 4);
+
+  rcache_clean();
+
   switch (size) {
   case 0: // 8
     // XXX: consider inlining sh2_drc_write8
-    if (delay) {
-      emith_call(sh2_drc_write8_slot);
-    } else {
-      emit_move_r_imm32(SHR_PC, pc);
-      rcache_clean();
-      emith_call(sh2_drc_write8);
-    }
+    emith_call(sh2_drc_write8);
     break;
   case 1: // 16
-    if (delay) {
-      emith_call(sh2_drc_write16_slot);
-    } else {
-      emit_move_r_imm32(SHR_PC, pc);
-      rcache_clean();
-      emith_call(sh2_drc_write16);
-    }
+    emith_call(sh2_drc_write16);
     break;
   case 2: // 32
     emith_move_r_r(ctxr, CONTEXT_REG);
     emith_call(sh2_drc_write32);
     break;
   }
+
   rcache_invalidate();
+  if (reg_map_g2h[SHR_SR] != -1)
+    emith_ctx_read(reg_map_g2h[SHR_SR], SHR_SR * 4);
 }
 
 // @(Rx,Ry)
@@ -1122,13 +1352,15 @@ static void emit_do_static_regs(int is_write, int tmpr)
 
 static void emit_block_entry(void)
 {
-  int arg0, arg1, arg2;
+  int arg0;
 
   host_arg2reg(arg0, 0);
+
+#if (DRC_DEBUG & 8) || defined(PDB)
+  int arg1, arg2;
   host_arg2reg(arg1, 1);
   host_arg2reg(arg2, 2);
 
-#if (DRC_DEBUG & 8) || defined(PDB)
   emit_do_static_regs(1, arg2);
   emith_move_r_r(arg1, CONTEXT_REG);
   emith_move_r_r(arg2, rcache_get_reg(SHR_SR, RC_GR_READ));
@@ -1141,16 +1373,12 @@ static void emit_block_entry(void)
   EMITH_SJMP_END(DCOND_EQ);
 }
 
-#define DELAYED_OP \
-  drcf.delayed_op = 2
-
 #define DELAY_SAVE_T(sr) { \
   emith_bic_r_imm(sr, T_save); \
   emith_tst_r_imm(sr, T);      \
   EMITH_SJMP_START(DCOND_EQ);  \
   emith_or_r_imm_c(DCOND_NE, sr, T_save); \
   EMITH_SJMP_END(DCOND_EQ);    \
-  drcf.use_saved_t = 1;        \
 }
 
 #define FLUSH_CYCLES(sr) \
@@ -1159,67 +1387,42 @@ static void emit_block_entry(void)
     cycles = 0; \
   }
 
-#define CHECK_UNHANDLED_BITS(mask) { \
-  if ((op & (mask)) != 0) \
-    goto default_; \
-}
-
-#define FETCH_OP(pc) \
-  dr_pc_base[(pc) / 2]
-
-#define FETCH32(a) \
-  ((dr_pc_base[(a) / 2] << 16) | dr_pc_base[(a) / 2 + 1])
-
-#define GET_Fx() \
-  ((op >> 4) & 0x0f)
-
-#define GET_Rm GET_Fx
-
-#define GET_Rn() \
-  ((op >> 8) & 0x0f)
-
-#define CHECK_FX_LT(n) \
-  if (GET_Fx() >= n) \
-    goto default_
-
-// op_flags: data from 1st pass
-#define OP_FLAGS(pc) op_flags[((pc) - base_pc) / 2]
-#define OF_DELAY_OP (1 << 0)
+static void *dr_get_pc_base(u32 pc, int is_slave);
 
 static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
 {
-  // XXX: maybe use structs instead?
   u32 branch_target_pc[MAX_LOCAL_BRANCHES];
   void *branch_target_ptr[MAX_LOCAL_BRANCHES];
-  int branch_target_blkid[MAX_LOCAL_BRANCHES];
   int branch_target_count = 0;
   void *branch_patch_ptr[MAX_LOCAL_BRANCHES];
   u32 branch_patch_pc[MAX_LOCAL_BRANCHES];
   int branch_patch_count = 0;
   u32 literal_addr[MAX_LITERALS];
   int literal_addr_count = 0;
-  int pending_branch_cond = -1;
-  int pending_branch_pc = 0;
-  u8 op_flags[BLOCK_CYCLE_LIMIT + 1];
+  u8 op_flags[BLOCK_INSN_LIMIT];
   struct {
-    u32 delayed_op:2;
     u32 test_irq:1;
-    u32 use_saved_t:1; // delayed op modifies T
+    u32 pending_branch_direct:1;
+    u32 pending_branch_indirect:1;
+    u32 literals_disabled:1;
   } drcf = { 0, };
 
-  // PC of current, first, last, last_target_blk SH2 insn
-  u32 pc, base_pc, end_pc, out_pc;
-  void *block_entry;
-  block_desc *this_block;
+  // PC of current, first, last SH2 insn
+  u32 pc, base_pc, end_pc;
+  u32 end_literals;
+  void *block_entry_ptr;
+  struct block_desc *block;
   u16 *dr_pc_base;
+  struct op_data *opd;
   int blkid_main = 0;
   int skip_op = 0;
   u32 tmp, tmp2;
   int cycles;
+  int i, v;
   int op;
-  int i;
 
   base_pc = sh2->pc;
+  drcf.literals_disabled = literal_disabled_frames != 0;
 
   // get base/validate PC
   dr_pc_base = dr_get_pc_base(base_pc, sh2->is_slave);
@@ -1230,9 +1433,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
   }
 
   tcache_ptr = tcache_ptrs[tcache_id];
-  this_block = dr_add_block(base_pc, sh2->is_slave, &blkid_main);
-  if (this_block == NULL)
-    return NULL;
 
   // predict tcache overflow
   tmp = tcache_ptr - tcache_bases[tcache_id];
@@ -1241,110 +1441,132 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
     return NULL;
   }
 
-  block_entry = tcache_ptr;
-  dbg(2, "== %csh2 block #%d,%d %08x -> %p", sh2->is_slave ? 's' : 'm',
-    tcache_id, blkid_main, base_pc, block_entry);
+  // initial passes to disassemble and analyze the block
+  scan_block(base_pc, sh2->is_slave, op_flags, &end_pc, &end_literals);
 
-  dr_link_blocks(tcache_ptr, base_pc, tcache_id);
+  if (drcf.literals_disabled)
+    end_literals = end_pc;
 
-  // 1st pass: scan forward for local branches
-  memset(op_flags, 0, sizeof(op_flags));
-  for (cycles = 0, pc = base_pc; cycles < BLOCK_CYCLE_LIMIT; cycles++, pc += 2) {
-    op = FETCH_OP(pc);
-    if ((op & 0xf000) == 0xa000 || (op & 0xf000) == 0xb000) { // BRA, BSR
-      signed int offs = ((signed int)(op << 20) >> 19);
-      pc += 2;
-      OP_FLAGS(pc) |= OF_DELAY_OP;
-      ADD_TO_ARRAY(branch_target_pc, branch_target_count, pc + offs + 2,);
-      break;
-    }
-    if ((op & 0xf000) == 0) {
-      op &= 0xff;
-      if (op == 0x1b) // SLEEP
-        break;
-      if (op == 0x23 || op == 0x03 || op == 0x0b || op == 0x2b) { // BRAF, BSRF, RTS, RTE
-        pc += 2;
-        OP_FLAGS(pc) |= OF_DELAY_OP;
-        break;
-      }
+  block = dr_add_block(base_pc, end_literals - base_pc,
+    end_pc - base_pc, sh2->is_slave, &blkid_main);
+  if (block == NULL)
+    return NULL;
+
+  block_entry_ptr = tcache_ptr;
+  dbg(2, "== %csh2 block #%d,%d %08x-%08x -> %p", sh2->is_slave ? 's' : 'm',
+    tcache_id, blkid_main, base_pc, end_pc, block_entry_ptr);
+
+  dr_link_blocks(&block->entryp[0], tcache_id);
+
+  // collect branch_targets that don't land on delay slots
+  for (pc = base_pc, i = 0; pc < end_pc; i++, pc += 2) {
+    if (!(op_flags[i] & OF_BTARGET))
+      continue;
+    if (op_flags[i] & OF_DELAY_OP) {
+      op_flags[i] &= ~OF_BTARGET;
       continue;
     }
-    if ((op & 0xf0df) == 0x400b) { // JMP, JSR
-      pc += 2;
-      OP_FLAGS(pc) |= OF_DELAY_OP;
-      break;
-    }
-    if ((op & 0xf900) == 0x8900) { // BT(S), BF(S)
-      signed int offs = ((signed int)(op << 24) >> 23);
-      if (op & 0x0400)
-        OP_FLAGS(pc + 2) |= OF_DELAY_OP;
-      ADD_TO_ARRAY(branch_target_pc, branch_target_count, pc + offs + 4, break);
-    }
-    if ((op & 0xff00) == 0xc300) // TRAPA
-      break;
+    ADD_TO_ARRAY(branch_target_pc, branch_target_count, pc, break);
   }
 
-  end_pc = pc;
-
-  // clean branch_targets that are not really local,
-  // and that land on delay slots
-  for (i = 0, tmp = 0; i < branch_target_count; i++) {
-    pc = branch_target_pc[i];
-    if (base_pc <= pc && pc <= end_pc && !(OP_FLAGS(pc) & OF_DELAY_OP))
-      branch_target_pc[tmp++] = branch_target_pc[i];
+  if (branch_target_count > 0) {
+    memset(branch_target_ptr, 0, sizeof(branch_target_ptr[0]) * branch_target_count);
   }
-  branch_target_count = tmp;
-  memset(branch_target_ptr, 0, sizeof(branch_target_ptr[0]) * branch_target_count);
-  memset(branch_target_blkid, 0, sizeof(branch_target_blkid[0]) * branch_target_count);
+
+  // clear stale state after compile errors
+  rcache_invalidate();
 
   // -------------------------------------------------
-  // 2nd pass: actual compilation
-  out_pc = 0;
+  // 3rd pass: actual compilation
   pc = base_pc;
-  for (cycles = 0; pc <= end_pc || drcf.delayed_op; )
+  cycles = 0;
+  for (i = 0; pc < end_pc; i++)
   {
+    u32 delay_dep_fw = 0, delay_dep_bk = 0;
     u32 tmp3, tmp4, sr;
 
-    if (drcf.delayed_op > 0)
-      drcf.delayed_op--;
-
+    opd = &ops[i];
     op = FETCH_OP(pc);
 
-    i = find_in_array(branch_target_pc, branch_target_count, pc);
-    if (i >= 0 || pc == base_pc)
+#if (DRC_DEBUG & 2)
+    insns_compiled++;
+#endif
+#if (DRC_DEBUG & 4)
+    DasmSH2(sh2dasm_buff, pc, op);
+    printf("%c%08x %04x %s\n", (op_flags[i] & OF_BTARGET) ? '*' : ' ',
+      pc, op, sh2dasm_buff);
+#endif
+
+    if ((op_flags[i] & OF_BTARGET) || pc == base_pc)
     {
       if (pc != base_pc)
       {
-        /* make "subblock" - just a mid-block entry */
-        block_desc *subblock;
-
         sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
         FLUSH_CYCLES(sr);
-        // decide if to flush rcache
-        if ((op & 0xf0ff) == 0x4010 && FETCH_OP(pc + 2) == 0x8bfd) // DT; BF #-2
-          rcache_clean();
-        else
-          rcache_flush();
-        do_host_disasm(tcache_id);
+        rcache_flush();
 
-        dbg(2, "-- %csh2 subblock #%d,%d %08x -> %p", sh2->is_slave ? 's' : 'm',
-          tcache_id, branch_target_blkid[i], pc, tcache_ptr);
+        // make block entry
+        v = block->entry_count;
+        if (v < ARRAY_SIZE(block->entryp))
+        {
+          struct block_entry *be_old;
 
-        subblock = dr_add_block(pc, sh2->is_slave, &branch_target_blkid[i]);
-        if (subblock == NULL)
-          return NULL;
+          block->entryp[v].pc = pc;
+          block->entryp[v].tcache_ptr = tcache_ptr;
+          block->entryp[v].links = NULL;
+#if (DRC_DEBUG & 2)
+          block->entryp[v].block = block;
+#endif
+          be_old = dr_get_entry(pc, sh2->is_slave, &tcache_id);
+          if (be_old != NULL) {
+            dbg(1, "entry override for %08x, was %p", pc, be_old->tcache_ptr);
+            kill_block_entry(be_old, tcache_id);
+          }
 
-        // since we made a block entry, link any other blocks that jump to current pc
-        dr_link_blocks(tcache_ptr, pc, tcache_id);
+          add_to_hashlist(&block->entryp[v], tcache_id);
+          block->entry_count++;
+
+          dbg(2, "-- %csh2 block #%d,%d entry %08x -> %p",
+            sh2->is_slave ? 's' : 'm', tcache_id, blkid_main,
+            pc, tcache_ptr);
+
+          // since we made a block entry, link any other blocks
+          // that jump to current pc
+          dr_link_blocks(&block->entryp[v], tcache_id);
+        }
+        else {
+          dbg(1, "too many entryp for block #%d,%d pc=%08x",
+            tcache_id, blkid_main, pc);
+        }
+
+        do_host_disasm(tcache_id);
       }
-      if (i >= 0)
-        branch_target_ptr[i] = tcache_ptr;
+
+      v = find_in_array(branch_target_pc, branch_target_count, pc);
+      if (v >= 0)
+        branch_target_ptr[v] = tcache_ptr;
 
       // must update PC
       emit_move_r_imm32(SHR_PC, pc);
       rcache_clean();
 
-      // check cycles
+#if (DRC_DEBUG & 0x10)
+      rcache_get_reg_arg(0, SHR_PC);
+      tmp = emit_memhandler_read(2);
+      tmp2 = rcache_get_tmp();
+      tmp3 = rcache_get_tmp();
+      emith_move_r_imm(tmp2, FETCH32(pc));
+      emith_move_r_imm(tmp3, 0);
+      emith_cmp_r_r(tmp, tmp2);
+      EMITH_SJMP_START(DCOND_EQ);
+      emith_read_r_r_offs_c(DCOND_NE, tmp3, tmp3, 0); // crash
+      EMITH_SJMP_END(DCOND_EQ);
+      rcache_free_tmp(tmp);
+      rcache_free_tmp(tmp2);
+      rcache_free_tmp(tmp3);
+#endif
+
+      // check cycles
       sr = rcache_get_reg(SHR_SR, RC_GR_READ);
       emith_cmp_r_imm(sr, 0);
       emith_jump_cond(DCOND_LE, sh2_drc_exit);
@@ -1352,22 +1574,172 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       rcache_unlock_all();
     }
 
-#if (DRC_DEBUG & 2)
-    insns_compiled++;
-#if (DRC_DEBUG & 4)
-    DasmSH2(sh2dasm_buff, pc, op);
-    printf("%08x %04x %s\n", pc, op, sh2dasm_buff);
-#endif
+#ifdef DRC_CMP
+    if (!(op_flags[i] & OF_DELAY_OP)) {
+      emit_move_r_imm32(SHR_PC, pc);
+      sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
+      FLUSH_CYCLES(sr);
+      rcache_clean();
+
+      tmp = rcache_used_hreg_mask();
+      emith_save_caller_regs(tmp);
+      emit_do_static_regs(1, 0);
+      emith_pass_arg_r(0, CONTEXT_REG);
+      emith_call(do_sh2_cmp);
+      emith_restore_caller_regs(tmp);
+    }
 #endif
 
     pc += 2;
-    cycles++;
 
     if (skip_op > 0) {
       skip_op--;
       continue;
     }
 
+    if (op_flags[i] & OF_DELAY_OP)
+    {
+      // handle delay slot dependencies
+      delay_dep_fw = opd->dest & ops[i-1].source;
+      delay_dep_bk = opd->source & ops[i-1].dest;
+      if (delay_dep_fw & BITMASK1(SHR_T)) {
+        sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
+        DELAY_SAVE_T(sr);
+      }
+      if (delay_dep_bk & BITMASK1(SHR_PC)) {
+        if (opd->op != OP_LOAD_POOL && opd->op != OP_MOVA) {
+          // can only be those 2 really..
+          elprintf_sh2(sh2, EL_ANOMALY,
+            "drc: illegal slot insn %04x @ %08x?", op, pc - 2);
+        }
+        if (opd->imm != 0)
+          ; // addr already resolved somehow
+        else {
+          switch (ops[i-1].op) {
+          case OP_BRANCH:
+            emit_move_r_imm32(SHR_PC, ops[i-1].imm);
+            break;
+          case OP_BRANCH_CT:
+          case OP_BRANCH_CF:
+            tmp = rcache_get_reg(SHR_PC, RC_GR_WRITE);
+            sr = rcache_get_reg(SHR_SR, RC_GR_READ);
+            emith_move_r_imm(tmp, pc);
+            emith_tst_r_imm(sr, T);
+            tmp2 = ops[i-1].op == OP_BRANCH_CT ? DCOND_NE : DCOND_EQ;
+            emith_move_r_imm_c(tmp2, tmp, ops[i-1].imm);
+            break;
+          // case OP_BRANCH_R OP_BRANCH_RF - PC already loaded
+          }
+        }
+      }
+      //if (delay_dep_fw & ~BITMASK1(SHR_T))
+      //  dbg(1, "unhandled delay_dep_fw: %x", delay_dep_fw & ~BITMASK1(SHR_T));
+      if (delay_dep_bk & ~BITMASK2(SHR_PC, SHR_PR))
+        dbg(1, "unhandled delay_dep_bk: %x", delay_dep_bk);
+    }
+
+    switch (opd->op)
+    {
+    case OP_BRANCH:
+    case OP_BRANCH_CT:
+    case OP_BRANCH_CF:
+      if (opd->dest & BITMASK1(SHR_PR))
+        emit_move_r_imm32(SHR_PR, pc + 2);
+      drcf.pending_branch_direct = 1;
+      goto end_op;
+
+    case OP_BRANCH_R:
+      if (opd->dest & BITMASK1(SHR_PR))
+        emit_move_r_imm32(SHR_PR, pc + 2);
+      emit_move_r_r(SHR_PC, opd->rm);
+      drcf.pending_branch_indirect = 1;
+      goto end_op;
+
+    case OP_BRANCH_RF:
+      tmp  = rcache_get_reg(SHR_PC, RC_GR_WRITE);
+      tmp2 = rcache_get_reg(GET_Rn(), RC_GR_READ);
+      if (opd->dest & BITMASK1(SHR_PR)) {
+        tmp3 = rcache_get_reg(SHR_PR, RC_GR_WRITE);
+        emith_move_r_imm(tmp3, pc + 2);
+        emith_add_r_r_r(tmp, tmp2, tmp3);
+      }
+      else {
+        emith_move_r_r(tmp, tmp2);
+        emith_add_r_imm(tmp, pc + 2);
+      }
+      drcf.pending_branch_indirect = 1;
+      goto end_op;
+
+    case OP_SLEEP:
+      printf("TODO sleep\n");
+      goto end_op;
+
+    case OP_RTE:
+      // pop PC
+      emit_memhandler_read_rr(SHR_PC, SHR_SP, 0, 2);
+      // pop SR
+      tmp = rcache_get_reg_arg(0, SHR_SP);
+      emith_add_r_imm(tmp, 4);
+      tmp = emit_memhandler_read(2);
+      sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
+      emith_write_sr(sr, tmp);
+      rcache_free_tmp(tmp);
+      tmp = rcache_get_reg(SHR_SP, RC_GR_RMW);
+      emith_add_r_imm(tmp, 4*2);
+      drcf.test_irq = 1;
+      drcf.pending_branch_indirect = 1;
+      goto end_op;
+
+    case OP_LOAD_POOL:
+#if PROPAGATE_CONSTANTS
+      if (opd->imm != 0 && opd->imm < end_literals
+          && literal_addr_count < MAX_LITERALS)
+      {
+        ADD_TO_ARRAY(literal_addr, literal_addr_count, opd->imm,);
+        if (opd->size == 2)
+          tmp = FETCH32(opd->imm);
+        else
+          tmp = (u32)(int)(signed short)FETCH_OP(opd->imm);
+        gconst_new(GET_Rn(), tmp);
+      }
+      else
+#endif
+      {
+        tmp = rcache_get_tmp_arg(0);
+        if (opd->imm != 0)
+          emith_move_r_imm(tmp, opd->imm);
+        else {
+          // have to calculate read addr from PC
+          tmp2 = rcache_get_reg(SHR_PC, RC_GR_READ);
+          if (opd->size == 2) {
+            emith_add_r_r_imm(tmp, tmp2, 2 + (op & 0xff) * 4);
+            emith_bic_r_imm(tmp, 3);
+          }
+          else
+            emith_add_r_r_imm(tmp, tmp2, 2 + (op & 0xff) * 2);
+        }
+        tmp2 = emit_memhandler_read(opd->size);
+        tmp3 = rcache_get_reg(GET_Rn(), RC_GR_WRITE);
+        if (opd->size == 2)
+          emith_move_r_r(tmp3, tmp2);
+        else
+          emith_sext(tmp3, tmp2, 16);
+        rcache_free_tmp(tmp2);
+      }
+      goto end_op;
+
+    case OP_MOVA:
+      if (opd->imm != 0)
+        emit_move_r_imm32(SHR_R0, opd->imm);
+      else {
+        tmp = rcache_get_reg(SHR_R0, RC_GR_WRITE);
+        tmp2 = rcache_get_reg(SHR_PC, RC_GR_READ);
+        emith_add_r_r_imm(tmp, tmp2, 2 + (op & 0xff) * 4);
+        emith_bic_r_imm(tmp, 3);
+      }
+      goto end_op;
+    }
+
     switch ((op >> 12) & 0x0f)
     {
     /////////////////////////////////////////////
@@ -1395,24 +1767,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         if (tmp2 == SHR_SR)
           emith_clear_msb(tmp, tmp, 22); // reserved bits defined by ISA as 0
         goto end_op;
-      case 0x03:
-        CHECK_UNHANDLED_BITS(0xd0);
-        // BRAF Rm    0000mmmm00100011
-        // BSRF Rm    0000mmmm00000011
-        DELAYED_OP;
-        tmp  = rcache_get_reg(SHR_PC, RC_GR_WRITE);
-        tmp2 = rcache_get_reg(GET_Rn(), RC_GR_READ);
-        emith_move_r_r(tmp, tmp2);
-        if (op & 0x20)
-          emith_add_r_imm(tmp, pc + 2);
-        else { // BSRF
-          tmp3 = rcache_get_reg(SHR_PR, RC_GR_WRITE);
-          emith_move_r_imm(tmp3, pc + 2);
-          emith_add_r_r(tmp, tmp3);
-        }
-        out_pc = (u32)-1;
-        cycles++;
-        goto end_op;
       case 0x04: // MOV.B Rm,@(R0,Rn)   0000nnnnmmmm0100
       case 0x05: // MOV.W Rm,@(R0,Rn)   0000nnnnmmmm0101
       case 0x06: // MOV.L Rm,@(R0,Rn)   0000nnnnmmmm0110
@@ -1421,7 +1775,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp2 = rcache_get_reg_arg(0, SHR_R0);
         tmp3 = rcache_get_reg(GET_Rn(), RC_GR_READ);
         emith_add_r_r(tmp2, tmp3);
-        emit_memhandler_write(op & 3, pc, drcf.delayed_op);
+        emit_memhandler_write(op & 3);
         goto end_op;
       case 0x07:
         // MUL.L     Rm,Rn      0000nnnnmmmm0111
@@ -1429,22 +1783,16 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp2 = rcache_get_reg(GET_Rm(), RC_GR_READ);
         tmp3 = rcache_get_reg(SHR_MACL, RC_GR_WRITE);
         emith_mul(tmp3, tmp2, tmp);
-        cycles++;
         goto end_op;
       case 0x08:
-        CHECK_UNHANDLED_BITS(0xf00);
         switch (GET_Fx())
         {
         case 0: // CLRT               0000000000001000
           sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_bic_r_imm(sr, T);
           break;
         case 1: // SETT               0000000000011000
           sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_or_r_imm(sr, T);
           break;
         case 2: // CLRMAC             0000000000101000
@@ -1459,13 +1807,9 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         switch (GET_Fx())
         {
         case 0: // NOP        0000000000001001
-          CHECK_UNHANDLED_BITS(0xf00);
           break;
         case 1: // DIV0U      0000000000011001
-          CHECK_UNHANDLED_BITS(0xf00);
           sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_bic_r_imm(sr, M|Q|T);
           break;
         case 2: // MOVT Rn    0000nnnn00101001
@@ -1496,43 +1840,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp2 = rcache_get_reg(tmp2, RC_GR_READ);
         emith_move_r_r(tmp, tmp2);
         goto end_op;
-      case 0x0b:
-        CHECK_UNHANDLED_BITS(0xf00);
-        switch (GET_Fx())
-        {
-        case 0: // RTS        0000000000001011
-          DELAYED_OP;
-          emit_move_r_r(SHR_PC, SHR_PR);
-          out_pc = (u32)-1;
-          cycles++;
-          break;
-        case 1: // SLEEP      0000000000011011
-          tmp = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          emith_clear_msb(tmp, tmp, 20); // clear cycles
-          out_pc = out_pc - 2;
-          cycles = 1;
-          goto end_op;
-        case 2: // RTE        0000000000101011
-          DELAYED_OP;
-          // pop PC
-          emit_memhandler_read_rr(SHR_PC, SHR_SP, 0, 2);
-          // pop SR
-          tmp = rcache_get_reg_arg(0, SHR_SP);
-          emith_add_r_imm(tmp, 4);
-          tmp = emit_memhandler_read(2);
-          sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          emith_write_sr(sr, tmp);
-          rcache_free_tmp(tmp);
-          tmp = rcache_get_reg(SHR_SP, RC_GR_RMW);
-          emith_add_r_imm(tmp, 4*2);
-          drcf.test_irq = 1;
-          out_pc = (u32)-1;
-          cycles += 3;
-          break;
-        default:
-          goto default_;
-        }
-        goto end_op;
       case 0x0c: // MOV.B    @(R0,Rm),Rn      0000nnnnmmmm1100
       case 0x0d: // MOV.W    @(R0,Rm),Rn      0000nnnnmmmm1101
       case 0x0e: // MOV.L    @(R0,Rm),Rn      0000nnnnmmmm1110
@@ -1575,7 +1882,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         EMITH_JMP_END(DCOND_EQ);
 
         rcache_free_tmp(tmp);
-        cycles += 3;
         goto end_op;
       }
       goto default_;
@@ -1588,7 +1894,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       tmp2 = rcache_get_reg_arg(1, GET_Rm());
       if (op & 0x0f)
         emith_add_r_imm(tmp, (op & 0x0f) * 4);
-      emit_memhandler_write(2, pc, drcf.delayed_op);
+      emit_memhandler_write(2);
       goto end_op;
 
     case 0x02:
@@ -1600,24 +1906,22 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         rcache_clean();
         rcache_get_reg_arg(0, GET_Rn());
         rcache_get_reg_arg(1, GET_Rm());
-        emit_memhandler_write(op & 3, pc, drcf.delayed_op);
+        emit_memhandler_write(op & 3);
         goto end_op;
-      case 0x04: // MOV.B Rm,@–Rn       0010nnnnmmmm0100
-      case 0x05: // MOV.W Rm,@–Rn       0010nnnnmmmm0101
-      case 0x06: // MOV.L Rm,@–Rn       0010nnnnmmmm0110
+      case 0x04: // MOV.B Rm,@-Rn       0010nnnnmmmm0100
+      case 0x05: // MOV.W Rm,@-Rn       0010nnnnmmmm0101
+      case 0x06: // MOV.L Rm,@-Rn       0010nnnnmmmm0110
+        rcache_get_reg_arg(1, GET_Rm()); // for Rm == Rn
         tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
         emith_sub_r_imm(tmp, (1 << (op & 3)));
         rcache_clean();
         rcache_get_reg_arg(0, GET_Rn());
-        rcache_get_reg_arg(1, GET_Rm());
-        emit_memhandler_write(op & 3, pc, drcf.delayed_op);
+        emit_memhandler_write(op & 3);
         goto end_op;
       case 0x07: // DIV0S Rm,Rn         0010nnnnmmmm0111
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
         tmp2 = rcache_get_reg(GET_Rn(), RC_GR_READ);
         tmp3 = rcache_get_reg(GET_Rm(), RC_GR_READ);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, M|Q|T);
         emith_tst_r_imm(tmp2, (1<<31));
         EMITH_SJMP_START(DCOND_EQ);
@@ -1636,8 +1940,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
         tmp2 = rcache_get_reg(GET_Rn(), RC_GR_READ);
         tmp3 = rcache_get_reg(GET_Rm(), RC_GR_READ);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, T);
         emith_tst_r_r(tmp2, tmp3);
         emit_or_t_if_eq(sr);
@@ -1663,17 +1965,15 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp3 = rcache_get_reg(GET_Rm(), RC_GR_READ);
         emith_eor_r_r_r(tmp, tmp2, tmp3);
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, T);
         emith_tst_r_imm(tmp, 0x000000ff);
-        emit_or_t_if_eq(tmp);
+        emit_or_t_if_eq(sr);
         emith_tst_r_imm(tmp, 0x0000ff00);
-        emit_or_t_if_eq(tmp);
+        emit_or_t_if_eq(sr);
         emith_tst_r_imm(tmp, 0x00ff0000);
-        emit_or_t_if_eq(tmp);
+        emit_or_t_if_eq(sr);
         emith_tst_r_imm(tmp, 0xff000000);
-        emit_or_t_if_eq(tmp);
+        emit_or_t_if_eq(sr);
         rcache_free_tmp(tmp);
         goto end_op;
       case 0x0d: // XTRCT  Rm,Rn        0010nnnnmmmm1101
@@ -1698,8 +1998,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           emith_clear_msb(tmp2, tmp3, 16);
         emith_mul(tmp, tmp, tmp2);
         rcache_free_tmp(tmp2);
-//      FIXME: causes timing issues in Doom?
-//        cycles++;
         goto end_op;
       }
       goto default_;
@@ -1716,8 +2014,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
         tmp2 = rcache_get_reg(GET_Rn(), RC_GR_READ);
         tmp3 = rcache_get_reg(GET_Rm(), RC_GR_READ);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, T);
         emith_cmp_r_r(tmp2, tmp3);
         switch (op & 0x07)
@@ -1758,8 +2054,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp2 = rcache_get_reg(GET_Rn(), RC_GR_RMW);
         tmp3 = rcache_get_reg(GET_Rm(), RC_GR_READ);
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_tpop_carry(sr, 0);
         emith_adcf_r_r(tmp2, tmp2);
         emith_tpush_carry(sr, 0);            // keep Q1 in T for now
@@ -1802,8 +2096,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp  = rcache_get_reg(GET_Rn(), RC_GR_RMW);
         tmp2 = rcache_get_reg(GET_Rm(), RC_GR_READ);
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         if (op & 4) { // adc
           emith_tpop_carry(sr, 0);
           emith_adcf_r_r(tmp, tmp2);
@@ -1819,8 +2111,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp  = rcache_get_reg(GET_Rn(), RC_GR_RMW);
         tmp2 = rcache_get_reg(GET_Rm(), RC_GR_READ);
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, T);
         if (op & 4) {
           emith_addf_r_r(tmp, tmp2);
@@ -1851,16 +2141,13 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         case 2: // SHAL Rn    0100nnnn00100000
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_tpop_carry(sr, 0); // dummy
           emith_lslf(tmp, tmp, 1);
           emith_tpush_carry(sr, 0);
           goto end_op;
         case 1: // DT Rn      0100nnnn00010000
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
+#if 0 // scheduling needs tuning
           if (FETCH_OP(pc) == 0x8bfd) { // BF #-2
             if (gconst_get(GET_Rn(), &tmp)) {
               // XXX: limit burned cycles
@@ -1873,6 +2160,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
               emith_sh2_dtbf_loop();
             goto end_op;
           }
+#endif
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           emith_bic_r_imm(sr, T);
           emith_subf_r_imm(tmp, 1);
@@ -1887,8 +2175,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         case 2: // SHAR Rn    0100nnnn00100001
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_tpop_carry(sr, 0); // dummy
           if (op & 0x20) {
             emith_asrf(tmp, tmp, 1);
@@ -1897,10 +2183,8 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           emith_tpush_carry(sr, 0);
           goto end_op;
         case 1: // CMP/PZ Rn  0100nnnn00010001
-          tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
+          tmp = rcache_get_reg(GET_Rn(), RC_GR_READ);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_bic_r_imm(sr, T);
           emith_cmp_r_imm(tmp, 0);
           EMITH_SJMP_START(DCOND_LT);
@@ -1913,22 +2197,22 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       case 0x03:
         switch (op & 0x3f)
         {
-        case 0x02: // STS.L    MACH,@–Rn 0100nnnn00000010
+        case 0x02: // STS.L    MACH,@-Rn 0100nnnn00000010
           tmp = SHR_MACH;
           break;
-        case 0x12: // STS.L    MACL,@–Rn 0100nnnn00010010
+        case 0x12: // STS.L    MACL,@-Rn 0100nnnn00010010
           tmp = SHR_MACL;
           break;
-        case 0x22: // STS.L    PR,@–Rn   0100nnnn00100010
+        case 0x22: // STS.L    PR,@-Rn   0100nnnn00100010
           tmp = SHR_PR;
           break;
-        case 0x03: // STC.L    SR,@–Rn   0100nnnn00000011
+        case 0x03: // STC.L    SR,@-Rn   0100nnnn00000011
           tmp = SHR_SR;
           break;
-        case 0x13: // STC.L    GBR,@–Rn  0100nnnn00010011
+        case 0x13: // STC.L    GBR,@-Rn  0100nnnn00010011
           tmp = SHR_GBR;
           break;
-        case 0x23: // STC.L    VBR,@–Rn  0100nnnn00100011
+        case 0x23: // STC.L    VBR,@-Rn  0100nnnn00100011
           tmp = SHR_VBR;
           break;
         default:
@@ -1941,7 +2225,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp3 = rcache_get_reg_arg(1, tmp);
         if (tmp == SHR_SR)
           emith_clear_msb(tmp3, tmp3, 22); // reserved bits defined by ISA as 0
-        emit_memhandler_write(2, pc, drcf.delayed_op);
+        emit_memhandler_write(2);
         goto end_op;
       case 0x04:
       case 0x05:
@@ -1951,8 +2235,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         case 0x05: // ROTR   Rn          0100nnnn00000101
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_tpop_carry(sr, 0); // dummy
           if (op & 1) {
             emith_rorf(tmp, tmp, 1);
@@ -1964,8 +2246,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         case 0x25: // ROTCR  Rn          0100nnnn00100101
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_tpop_carry(sr, 0);
           if (op & 1) {
             emith_rorcf(tmp);
@@ -1976,8 +2256,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         case 0x15: // CMP/PL Rn          0100nnnn00010101
           tmp = rcache_get_reg(GET_Rn(), RC_GR_RMW);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_bic_r_imm(sr, T);
           emith_cmp_r_imm(tmp, 0);
           EMITH_SJMP_START(DCOND_LE);
@@ -2015,8 +2293,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp2 = emit_memhandler_read(2);
         if (tmp == SHR_SR) {
           sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_write_sr(sr, tmp2);
           drcf.test_irq = 1;
         } else {
@@ -2075,22 +2351,11 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       case 0x0b:
         switch (GET_Fx())
         {
-        case 0: // JSR  @Rm   0100mmmm00001011
-        case 2: // JMP  @Rm   0100mmmm00101011
-          DELAYED_OP;
-          if (!(op & 0x20))
-            emit_move_r_imm32(SHR_PR, pc + 2);
-          emit_move_r_r(SHR_PC, (op >> 8) & 0x0f);
-          out_pc = (u32)-1;
-          cycles++;
-          break;
         case 1: // TAS.B @Rn  0100nnnn00011011
           // XXX: is TAS working on 32X?
           rcache_get_reg_arg(0, GET_Rn());
           tmp = emit_memhandler_read(0);
           sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_bic_r_imm(sr, T);
           emith_cmp_r_imm(tmp, 0);
           emit_or_t_if_eq(sr);
@@ -2100,8 +2365,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           emith_move_r_r(tmp2, tmp);
           rcache_free_tmp(tmp);
           rcache_get_reg_arg(0, GET_Rn());
-          emit_memhandler_write(0, pc, drcf.delayed_op);
-          cycles += 3;
+          emit_memhandler_write(0);
           break;
         default:
           goto default_;
@@ -2125,8 +2389,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         }
         if (tmp2 == SHR_SR) {
           sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_write_sr(sr, tmp);
           drcf.test_irq = 1;
         } else {
@@ -2160,7 +2422,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
 
         EMITH_JMP_END(DCOND_EQ);
         rcache_free_tmp(tmp);
-        cycles += 2;
         goto end_op;
       }
       goto default_;
@@ -2218,8 +2479,6 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
           break;
         case 0x0a: // NEGC   Rm,Rn        0110nnnnmmmm1010
           sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-          if (drcf.delayed_op)
-            DELAY_SAVE_T(sr);
           emith_tpop_carry(sr, 1);
           emith_negcf_r_r(tmp2, tmp);
           emith_tpush_carry(sr, 1);
@@ -2266,7 +2525,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp3 = (op & 0x100) >> 8;
         if (op & 0x0f)
           emith_add_r_imm(tmp, (op & 0x0f) << tmp3);
-        emit_memhandler_write(tmp3, pc, drcf.delayed_op);
+        emit_memhandler_write(tmp3);
         goto end_op;
       case 0x0400: // MOV.B @(disp,Rm),R0  10000100mmmmdddd
       case 0x0500: // MOV.W @(disp,Rm),R0  10000101mmmmdddd
@@ -2278,73 +2537,15 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp  = rcache_get_tmp();
         tmp2 = rcache_get_reg(0, RC_GR_READ);
         sr   = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_move_r_imm_s8(tmp, op & 0xff);
         emith_bic_r_imm(sr, T);
         emith_cmp_r_r(tmp2, tmp);
         emit_or_t_if_eq(sr);
         rcache_free_tmp(tmp);
         goto end_op;
-      case 0x0d00: // BT/S label 10001101dddddddd
-      case 0x0f00: // BF/S label 10001111dddddddd
-        DELAYED_OP;
-        cycles--;
-        // fallthrough
-      case 0x0900: // BT   label 10001001dddddddd
-      case 0x0b00: // BF   label 10001011dddddddd
-        // will handle conditional branches later
-        pending_branch_cond = (op & 0x0200) ? DCOND_EQ : DCOND_NE;
-        i = ((signed int)(op << 24) >> 23);
-        pending_branch_pc = pc + i + 2;
-        cycles += 2;
-        goto end_op;
       }
       goto default_;
 
-    /////////////////////////////////////////////
-    case 0x09:
-      // MOV.W @(disp,PC),Rn  1001nnnndddddddd
-      tmp = pc + (op & 0xff) * 2 + 2;
-#if PROPAGATE_CONSTANTS
-      if (tmp < end_pc + MAX_LITERAL_OFFSET && literal_addr_count < MAX_LITERALS) {
-        ADD_TO_ARRAY(literal_addr, literal_addr_count, tmp,);
-        gconst_new(GET_Rn(), (u32)(int)(signed short)FETCH_OP(tmp));
-      }
-      else
-#endif
-      {
-        tmp2 = rcache_get_tmp_arg(0);
-        emith_move_r_imm(tmp2, tmp);
-        tmp2 = emit_memhandler_read(1);
-        tmp3 = rcache_get_reg(GET_Rn(), RC_GR_WRITE);
-        emith_sext(tmp3, tmp2, 16);
-        rcache_free_tmp(tmp2);
-      }
-      goto end_op;
-
-    /////////////////////////////////////////////
-    case 0x0a:
-      // BRA  label 1010dddddddddddd
-      DELAYED_OP;
-      sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-      tmp = ((signed int)(op << 20) >> 19);
-      out_pc = pc + tmp + 2;
-      if (tmp == (u32)-4)
-        emith_clear_msb(sr, sr, 20); // burn cycles
-      cycles++;
-      break;
-
-    /////////////////////////////////////////////
-    case 0x0b:
-      // BSR  label 1011dddddddddddd
-      DELAYED_OP;
-      emit_move_r_imm32(SHR_PR, pc + 2);
-      tmp = ((signed int)(op << 20) >> 19);
-      out_pc = pc + tmp + 2;
-      cycles++;
-      break;
-
     /////////////////////////////////////////////
     case 0x0c:
       switch (op & 0x0f00)
@@ -2357,7 +2558,7 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp2 = rcache_get_reg_arg(1, SHR_R0);
         tmp3 = (op & 0x300) >> 8;
         emith_add_r_imm(tmp, (op & 0xff) << tmp3);
-        emit_memhandler_write(tmp3, pc, drcf.delayed_op);
+        emit_memhandler_write(tmp3);
         goto end_op;
       case 0x0400: // MOV.B @(disp,GBR),R0   11000100dddddddd
       case 0x0500: // MOV.W @(disp,GBR),R0   11000101dddddddd
@@ -2373,25 +2574,21 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         emith_add_r_imm(tmp, 4);
         tmp = rcache_get_reg_arg(1, SHR_SR);
         emith_clear_msb(tmp, tmp, 22);
-        emit_memhandler_write(2, pc, drcf.delayed_op);
+        emit_memhandler_write(2);
         // push PC
         rcache_get_reg_arg(0, SHR_SP);
         tmp = rcache_get_tmp_arg(1);
         emith_move_r_imm(tmp, pc);
-        emit_memhandler_write(2, pc, drcf.delayed_op);
+        emit_memhandler_write(2);
         // obtain new PC
         emit_memhandler_read_rr(SHR_PC, SHR_VBR, (op & 0xff) * 4, 2);
-        out_pc = (u32)-1;
-        cycles += 7;
-        goto end_op;
-      case 0x0700: // MOVA @(disp,PC),R0    11000111dddddddd
-        emit_move_r_imm32(SHR_R0, (pc + (op & 0xff) * 4 + 2) & ~3);
+        // indirect jump -> back to dispatcher
+        rcache_flush();
+        emith_jump(sh2_drc_dispatcher);
         goto end_op;
       case 0x0800: // TST #imm,R0           11001000iiiiiiii
         tmp = rcache_get_reg(SHR_R0, RC_GR_READ);
         sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, T);
         emith_tst_r_imm(tmp, op & 0xff);
         emit_or_t_if_eq(sr);
@@ -2411,13 +2608,10 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
       case 0x0c00: // TST.B #imm,@(R0,GBR)  11001100iiiiiiii
         tmp = emit_indirect_indexed_read(SHR_R0, SHR_GBR, 0);
         sr  = rcache_get_reg(SHR_SR, RC_GR_RMW);
-        if (drcf.delayed_op)
-          DELAY_SAVE_T(sr);
         emith_bic_r_imm(sr, T);
         emith_tst_r_imm(tmp, op & 0xff);
         emit_or_t_if_eq(sr);
         rcache_free_tmp(tmp);
-        cycles += 2;
         goto end_op;
       case 0x0d00: // AND.B #imm,@(R0,GBR)  11001101iiiiiiii
         tmp = emit_indirect_indexed_read(SHR_R0, SHR_GBR, 0);
@@ -2437,33 +2631,11 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
         tmp3 = rcache_get_reg_arg(0, SHR_GBR);
         tmp4 = rcache_get_reg(SHR_R0, RC_GR_READ);
         emith_add_r_r(tmp3, tmp4);
-        emit_memhandler_write(0, pc, drcf.delayed_op);
-        cycles += 2;
+        emit_memhandler_write(0);
         goto end_op;
       }
       goto default_;
 
-    /////////////////////////////////////////////
-    case 0x0d:
-      // MOV.L @(disp,PC),Rn  1101nnnndddddddd
-      tmp = (pc + (op & 0xff) * 4 + 2) & ~3;
-#if PROPAGATE_CONSTANTS
-      if (tmp < end_pc + MAX_LITERAL_OFFSET && literal_addr_count < MAX_LITERALS) {
-        ADD_TO_ARRAY(literal_addr, literal_addr_count, tmp,);
-        gconst_new(GET_Rn(), FETCH32(tmp));
-      }
-      else
-#endif
-      {
-        tmp2 = rcache_get_tmp_arg(0);
-        emith_move_r_imm(tmp2, tmp);
-        tmp2 = emit_memhandler_read(2);
-        tmp3 = rcache_get_reg(GET_Rn(), RC_GR_WRITE);
-        emith_move_r_r(tmp3, tmp2);
-        rcache_free_tmp(tmp2);
-      }
-      goto end_op;
-
     /////////////////////////////////////////////
     case 0x0e:
       // MOV #imm,Rn   1110nnnniiiiiiii
@@ -2472,100 +2644,150 @@ static void REGPARM(2) *sh2_translate(SH2 *sh2, int tcache_id)
 
     default:
     default_:
-      elprintf(EL_ANOMALY, "%csh2 drc: unhandled op %04x @ %08x",
-        sh2->is_slave ? 's' : 'm', op, pc - 2);
-#ifdef DRC_DEBUG_INTERP
-      emit_move_r_imm32(SHR_PC, pc - 2);
+      if (!(op_flags[i] & OF_B_IN_DS))
+        elprintf_sh2(sh2, EL_ANOMALY,
+          "drc: illegal op %04x @ %08x", op, pc - 2);
+
+      tmp = rcache_get_reg(SHR_SP, RC_GR_RMW);
+      emith_sub_r_imm(tmp, 4*2);
+      // push SR
+      tmp = rcache_get_reg_arg(0, SHR_SP);
+      emith_add_r_imm(tmp, 4);
+      tmp = rcache_get_reg_arg(1, SHR_SR);
+      emith_clear_msb(tmp, tmp, 22);
+      emit_memhandler_write(2);
+      // push PC
+      rcache_get_reg_arg(0, SHR_SP);
+      tmp = rcache_get_tmp_arg(1);
+      if (drcf.pending_branch_indirect) {
+        tmp2 = rcache_get_reg(SHR_PC, RC_GR_READ);
+        emith_move_r_r(tmp, tmp2);
+      }
+      else
+        emith_move_r_imm(tmp, pc - 2);
+      emit_memhandler_write(2);
+      // obtain new PC
+      v = (op_flags[i] & OF_B_IN_DS) ? 6 : 4;
+      emit_memhandler_read_rr(SHR_PC, SHR_VBR, v * 4, 2);
+      // indirect jump -> back to dispatcher
       rcache_flush();
-      emith_pass_arg_r(0, CONTEXT_REG);
-      emith_pass_arg_imm(1, op);
-      emith_call(sh2_do_op);
-#endif
+      emith_jump(sh2_drc_dispatcher);
       break;
     }
 
 end_op:
     rcache_unlock_all();
 
-    // conditional branch handling (with/without delay)
-    if (pending_branch_cond != -1 && drcf.delayed_op != 2)
+    cycles += opd->cycles;
+
+    if (op_flags[i+1] & OF_DELAY_OP) {
+      do_host_disasm(tcache_id);
+      continue;
+    }
+
+    // test irq?
+    if (drcf.test_irq && !drcf.pending_branch_direct) {
+      sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
+      FLUSH_CYCLES(sr);
+      if (!drcf.pending_branch_indirect)
+        emit_move_r_imm32(SHR_PC, pc);
+      rcache_flush();
+      emith_call(sh2_drc_test_irq);
+      drcf.test_irq = 0;
+    }
+
+    // branch handling (with/without delay)
+    if (drcf.pending_branch_direct)
     {
-      u32 target_pc = pending_branch_pc;
-      void *target;
+      struct op_data *opd_b =
+        (op_flags[i] & OF_DELAY_OP) ? &ops[i-1] : opd;
+      u32 target_pc = opd_b->imm;
+      int cond = -1;
+      void *target = NULL;
 
       sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-      // handle cycles
       FLUSH_CYCLES(sr);
+
+      if (opd_b->op != OP_BRANCH)
+        cond = (opd_b->op == OP_BRANCH_CF) ? DCOND_EQ : DCOND_NE;
+      if (cond != -1) {
+        int ctaken = (op_flags[i] & OF_DELAY_OP) ? 1 : 2;
+
+        if (delay_dep_fw & BITMASK1(SHR_T))
+          emith_tst_r_imm(sr, T_save);
+        else
+          emith_tst_r_imm(sr, T);
+
+        emith_sub_r_imm_c(cond, sr, ctaken<<12);
+      }
       rcache_clean();
-      if (drcf.use_saved_t)
-        emith_tst_r_imm(sr, T_save);
-      else
-        emith_tst_r_imm(sr, T);
 
 #if LINK_BRANCHES
-      if (find_in_array(branch_target_pc, branch_target_count, target_pc) >= 0) {
+      if (find_in_array(branch_target_pc, branch_target_count, target_pc) >= 0)
+      {
         // local branch
         // XXX: jumps back can be linked already
-        branch_patch_pc[branch_patch_count] = target_pc;
-        branch_patch_ptr[branch_patch_count] = tcache_ptr;
-        emith_jump_cond_patchable(pending_branch_cond, tcache_ptr);
-
-        branch_patch_count++;
-        if (branch_patch_count == MAX_LOCAL_BRANCHES) {
-          dbg(1, "warning: too many local branches");
-          break;
+        if (branch_patch_count < MAX_LOCAL_BRANCHES) {
+          target = tcache_ptr;
+          branch_patch_pc[branch_patch_count] = target_pc;
+          branch_patch_ptr[branch_patch_count] = target;
+          branch_patch_count++;
         }
+        else
+          dbg(1, "warning: too many local branches");
       }
-      else
+
+      if (target == NULL)
 #endif
       {
         // can't resolve branch locally, make a block exit
         emit_move_r_imm32(SHR_PC, target_pc);
         rcache_clean();
 
-        target = dr_prepare_ext_branch(target_pc, sh2, tcache_id);
+        target = dr_prepare_ext_branch(target_pc, sh2->is_slave, tcache_id);
         if (target == NULL)
           return NULL;
-        emith_jump_cond_patchable(pending_branch_cond, target);
       }
 
-      drcf.use_saved_t = 0;
-      pending_branch_cond = -1;
-    }
+      if (cond != -1)
+        emith_jump_cond_patchable(cond, target);
+      else {
+        emith_jump_patchable(target);
+        rcache_invalidate();
+      }
 
-    // test irq?
-    // XXX: delay slots..
-    if (drcf.test_irq && drcf.delayed_op != 2) {
-      if (!drcf.delayed_op)
-        emit_move_r_imm32(SHR_PC, pc);
+      drcf.pending_branch_direct = 0;
+    }
+    else if (drcf.pending_branch_indirect) {
       sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
       FLUSH_CYCLES(sr);
       rcache_flush();
-      emith_call(sh2_drc_test_irq);
-      drcf.test_irq = 0;
+      emith_jump(sh2_drc_dispatcher);
+      drcf.pending_branch_indirect = 0;
     }
 
     do_host_disasm(tcache_id);
-
-    if (out_pc != 0 && drcf.delayed_op != 2)
-      break;
   }
 
   tmp = rcache_get_reg(SHR_SR, RC_GR_RMW);
   FLUSH_CYCLES(tmp);
   rcache_flush();
 
-  if (out_pc == (u32)-1) {
-    // indirect jump -> back to dispatcher
-    emith_jump(sh2_drc_dispatcher);
-  } else {
+  // check the last op
+  if (op_flags[i-1] & OF_DELAY_OP)
+    opd = &ops[i-2];
+  else
+    opd = &ops[i-1];
+
+  if (opd->op != OP_BRANCH && opd->op != OP_BRANCH_R
+      && opd->op != OP_BRANCH_RF && opd->op != OP_RTE)
+  {
     void *target;
-    if (out_pc == 0)
-      out_pc = pc;
-    emit_move_r_imm32(SHR_PC, out_pc);
+
+    emit_move_r_imm32(SHR_PC, pc);
     rcache_flush();
 
-    target = dr_prepare_ext_branch(out_pc, sh2, tcache_id);
+    target = dr_prepare_ext_branch(pc, sh2->is_slave, tcache_id);
     if (target == NULL)
       return NULL;
     emith_jump_patchable(target);
@@ -2588,14 +2810,13 @@ end_op:
     emith_jump_patch(branch_patch_ptr[i], target);
   }
 
-  end_pc = pc;
-
   // mark memory blocks as containing compiled code
   // override any overlay blocks as they become unreachable anyway
-  if (tcache_id != 0 || (this_block->addr & 0xc7fc0000) == 0x06000000)
+  if ((block->addr & 0xc7fc0000) == 0x06000000
+      || (block->addr & 0xfffff000) == 0xc0000000)
   {
     u16 *drc_ram_blk = NULL;
-    u32 mask = 0, shift = 0;
+    u32 addr, mask = 0, shift = 0;
 
     if (tcache_id != 0) {
       // data array, BIOS
@@ -2603,46 +2824,49 @@ end_op:
       shift = SH2_DRCBLK_DA_SHIFT;
       mask = 0xfff;
     }
-    else if ((this_block->addr & 0xc7fc0000) == 0x06000000) {
+    else {
       // SDRAM
       drc_ram_blk = Pico32xMem->drcblk_ram;
       shift = SH2_DRCBLK_RAM_SHIFT;
       mask = 0x3ffff;
     }
 
-    drc_ram_blk[(base_pc >> shift) & mask] = (blkid_main << 1) | 1;
-    for (pc = base_pc + 2; pc < end_pc; pc += 2)
-      drc_ram_blk[(pc >> shift) & mask] = blkid_main << 1;
-
-    // mark subblocks
-    for (i = 0; i < branch_target_count; i++)
-      if (branch_target_blkid[i] != 0)
-        drc_ram_blk[(branch_target_pc[i] >> shift) & mask] =
-          (branch_target_blkid[i] << 1) | 1;
+    // mark recompiled insns
+    drc_ram_blk[(base_pc & mask) >> shift] = 1;
+    for (pc = base_pc; pc < end_pc; pc += 2)
+      drc_ram_blk[(pc & mask) >> shift] = 1;
 
     // mark literals
     for (i = 0; i < literal_addr_count; i++) {
       tmp = literal_addr[i];
-      drc_ram_blk[(tmp >> shift) & mask] = blkid_main << 1;
-      if (!(tmp & 3)) // assume long
-        drc_ram_blk[((tmp + 2) >> shift) & mask] = blkid_main << 1;
+      drc_ram_blk[(tmp & mask) >> shift] = 1;
+    }
+
+    // add to invalidation lookup lists
+    addr = base_pc & ~(INVAL_PAGE_SIZE - 1);
+    for (; addr < end_literals; addr += INVAL_PAGE_SIZE) {
+      i = (addr & mask) / INVAL_PAGE_SIZE;
+      add_to_block_list(&inval_lookup[tcache_id][i], block);
     }
   }
 
   tcache_ptrs[tcache_id] = tcache_ptr;
 
-  host_instructions_updated(block_entry, tcache_ptr);
+  host_instructions_updated(block_entry_ptr, tcache_ptr);
 
   do_host_disasm(tcache_id);
+
+  if (drcf.literals_disabled && literal_addr_count)
+    dbg(1, "literals_disabled && literal_addr_count?");
   dbg(2, " block #%d,%d tcache %d/%d, insns %d -> %d %.3f",
-    tcache_id, block_counts[tcache_id],
+    tcache_id, blkid_main,
     tcache_ptr - tcache_bases[tcache_id], tcache_sizes[tcache_id],
-    insns_compiled, host_insn_count, (double)host_insn_count / insns_compiled);
+    insns_compiled, host_insn_count, (float)host_insn_count / insns_compiled);
   if ((sh2->pc & 0xc6000000) == 0x02000000) // ROM
     dbg(2, "  hash collisions %d/%d", hash_collisions, block_counts[tcache_id]);
 /*
  printf("~~~\n");
- tcache_dsm_ptrs[tcache_id] = block_entry;
+ tcache_dsm_ptrs[tcache_id] = block_entry_ptr;
  do_host_disasm(tcache_id);
  printf("~~~\n");
 */
@@ -2651,13 +2875,12 @@ end_op:
   fflush(stdout);
 #endif
 
-  return block_entry;
+  return block_entry_ptr;
 }
 
 static void sh2_generate_utils(void)
 {
   int arg0, arg1, arg2, sr, tmp;
-  void *sh2_drc_write_end, *sh2_drc_write_slot_end;
 
   sh2_drc_write32 = p32x_sh2_write32;
   sh2_drc_read8  = p32x_sh2_read8;
@@ -2698,7 +2921,7 @@ static void sh2_generate_utils(void)
   emith_call(sh2_translate);
   emit_block_entry();
   // XXX: can't translate, fail
-  emith_call(exit);
+  emith_call(dr_failure);
 
   // sh2_drc_test_irq(void)
   // assumes it's called from main function (may jump to dispatcher)
@@ -2758,51 +2981,15 @@ static void sh2_generate_utils(void)
   emith_call(sh2_drc_test_irq);
   emith_jump(sh2_drc_dispatcher);
 
-  // write-caused irq detection
-  sh2_drc_write_end = tcache_ptr;
-  emith_tst_r_r(arg0, arg0);
-  EMITH_SJMP_START(DCOND_NE);
-  emith_jump_ctx_c(DCOND_EQ, offsetof(SH2, drc_tmp)); // return
-  EMITH_SJMP_END(DCOND_NE);
-  emith_call(sh2_drc_test_irq);
-  emith_jump_ctx(offsetof(SH2, drc_tmp));
-
-  // write-caused irq detection for writes in delay slot
-  sh2_drc_write_slot_end = tcache_ptr;
-  emith_tst_r_r(arg0, arg0);
-  EMITH_SJMP_START(DCOND_NE);
-  emith_jump_ctx_c(DCOND_EQ, offsetof(SH2, drc_tmp));
-  EMITH_SJMP_END(DCOND_NE);
-  // just burn cycles to get back to dispatcher after branch is handled
-  sr = rcache_get_reg(SHR_SR, RC_GR_RMW);
-  emith_ctx_write(sr, offsetof(SH2, irq_cycles));
-  emith_clear_msb(sr, sr, 20); // clear cycles
-  rcache_flush();
-  emith_jump_ctx(offsetof(SH2, drc_tmp));
-
   // sh2_drc_write8(u32 a, u32 d)
   sh2_drc_write8 = (void *)tcache_ptr;
-  emith_ret_to_ctx(offsetof(SH2, drc_tmp));
   emith_ctx_read(arg2, offsetof(SH2, write8_tab));
-  emith_sh2_wcall(arg0, arg2, sh2_drc_write_end);
+  emith_sh2_wcall(arg0, arg2);
 
   // sh2_drc_write16(u32 a, u32 d)
   sh2_drc_write16 = (void *)tcache_ptr;
-  emith_ret_to_ctx(offsetof(SH2, drc_tmp));
-  emith_ctx_read(arg2, offsetof(SH2, write16_tab));
-  emith_sh2_wcall(arg0, arg2, sh2_drc_write_end);
-
-  // sh2_drc_write8_slot(u32 a, u32 d)
-  sh2_drc_write8_slot = (void *)tcache_ptr;
-  emith_ret_to_ctx(offsetof(SH2, drc_tmp));
-  emith_ctx_read(arg2, offsetof(SH2, write8_tab));
-  emith_sh2_wcall(arg0, arg2, sh2_drc_write_slot_end);
-
-  // sh2_drc_write16_slot(u32 a, u32 d)
-  sh2_drc_write16_slot = (void *)tcache_ptr;
-  emith_ret_to_ctx(offsetof(SH2, drc_tmp));
   emith_ctx_read(arg2, offsetof(SH2, write16_tab));
-  emith_sh2_wcall(arg0, arg2, sh2_drc_write_slot_end);
+  emith_sh2_wcall(arg0, arg2);
 
 #ifdef PDB_NET
   // debug
@@ -2836,9 +3023,7 @@ static void sh2_generate_utils(void)
   MAKE_READ_WRAPPER(sh2_drc_read16);
   MAKE_READ_WRAPPER(sh2_drc_read32);
   MAKE_WRITE_WRAPPER(sh2_drc_write8);
-  MAKE_WRITE_WRAPPER(sh2_drc_write8_slot);
   MAKE_WRITE_WRAPPER(sh2_drc_write16);
-  MAKE_WRITE_WRAPPER(sh2_drc_write16_slot);
   MAKE_WRITE_WRAPPER(sh2_drc_write32);
 #if (DRC_DEBUG & 4)
   host_dasm_new_symbol(sh2_drc_read8);
@@ -2854,122 +3039,151 @@ static void sh2_generate_utils(void)
   host_dasm_new_symbol(sh2_drc_dispatcher);
   host_dasm_new_symbol(sh2_drc_exit);
   host_dasm_new_symbol(sh2_drc_test_irq);
-  host_dasm_new_symbol(sh2_drc_write_end);
-  host_dasm_new_symbol(sh2_drc_write_slot_end);
   host_dasm_new_symbol(sh2_drc_write8);
-  host_dasm_new_symbol(sh2_drc_write8_slot);
   host_dasm_new_symbol(sh2_drc_write16);
-  host_dasm_new_symbol(sh2_drc_write16_slot);
 #endif
 }
 
-static void *sh2_smc_rm_block_entry(block_desc *bd, int tcache_id)
+static void sh2_smc_rm_block(struct block_desc *bd, int tcache_id, u32 ram_mask)
 {
+  u32 i, addr, end_addr;
   void *tmp;
 
-  // XXX: kill links somehow?
-  dbg(2, "  killing entry %08x, blkid %d", bd->addr, bd - block_tables[tcache_id]);
-  if (bd->addr == 0 || bd->tcache_ptr == NULL) {
+  dbg(2, "  killing block %08x-%08x-%08x, blkid %d,%d",
+    bd->addr, bd->addr + bd->size_nolit, bd->addr + bd->size,
+    tcache_id, bd - block_tables[tcache_id]);
+  if (bd->addr == 0 || bd->entry_count == 0) {
     dbg(1, "  killing dead block!? %08x", bd->addr);
-    return bd->tcache_ptr;
+    return;
   }
 
-  // since we never reuse space of dead blocks,
-  // insert jump to dispatcher for blocks that are linked to this point
-  //emith_jump_at(bd->tcache_ptr, sh2_drc_dispatcher);
+  // remove from inval_lookup
+  addr = bd->addr & ~(INVAL_PAGE_SIZE - 1);
+  end_addr = bd->addr + bd->size;
+  for (; addr < end_addr; addr += INVAL_PAGE_SIZE) {
+    i = (addr & ram_mask) / INVAL_PAGE_SIZE;
+    rm_from_block_list(&inval_lookup[tcache_id][i], bd);
+  }
 
-  // attempt to handle self-modifying blocks by exiting at nearest known PC
   tmp = tcache_ptr;
-  tcache_ptr = bd->tcache_ptr;
-  emit_move_r_imm32(SHR_PC, bd->addr);
-  rcache_flush();
-  emith_jump(sh2_drc_dispatcher);
-  tcache_ptr = tmp;
 
-  bd->addr = 0;
-  return bd->tcache_ptr;
-}
+  // remove from hash table, make incoming links unresolved
+  // XXX: maybe patch branches w/flush instead?
+  for (i = 0; i < bd->entry_count; i++) {
+    rm_from_hashlist(&bd->entryp[i], tcache_id);
 
-static void sh2_smc_rm_block(u32 a, u16 *drc_ram_blk, int tcache_id, u32 shift, u32 mask)
-{
-  //block_link *bl = block_links[tcache_id];
-  //int bl_count = block_link_counts[tcache_id];
-  block_desc *btab = block_tables[tcache_id];
-  u16 *p = drc_ram_blk + ((a & mask) >> shift);
-  u16 *pmax = drc_ram_blk + (mask >> shift);
-  void *tcache_min, *tcache_max;
-  int zeros;
-  u16 *pt;
+    // since we never reuse tcache space of dead blocks,
+    // insert jump to dispatcher for blocks that are linked to this
+    tcache_ptr = bd->entryp[i].tcache_ptr;
+    emit_move_r_imm32(SHR_PC, bd->entryp[i].pc);
+    rcache_flush();
+    emith_jump(sh2_drc_dispatcher);
 
-  // Figure out what the main block is, as subblocks also have the flag set.
-  // This relies on sub having single entry. It's possible that innocent
-  // block might be hit, but that's not such a big deal.
-  if ((p[0] >> 1) != (p[1] >> 1)) {
-    for (; p > drc_ram_blk; p--)
-      if (p[-1] == 0 || (p[-1] >> 1) == (*p >> 1))
-        break;
+    host_instructions_updated(bd->entryp[i].tcache_ptr, tcache_ptr);
+
+    unregister_links(&bd->entryp[i], tcache_id);
   }
-  pt = p;
 
-  for (; p > drc_ram_blk; p--)
-    if ((*p & 1))
-      break;
+  tcache_ptr = tmp;
+
+  bd->addr = bd->size = bd->size_nolit = 0;
+  bd->entry_count = 0;
+}
+
+/*
+04205:243: == msh2 block #0,200 060017a8-060017f0 -> 0x27cb9c
+ 060017a8 d11c MOV.L   @($70,PC),R1  ; @$0600181c
 
-  if (!(*p & 1)) {
-    dbg(1, "smc rm: missing block start for %08x?", a);
-    p = pt;
+04230:261: msh2 xsh w32 [260017a8] d225e304
+04230:261: msh2 smc check @260017a8
+04239:226: = ssh2 enter 060017a8 0x27cb9c, c=173
+*/
+static void sh2_smc_rm_blocks(u32 a, u16 *drc_ram_blk, int tcache_id, u32 shift, u32 mask)
+{
+  struct block_list **blist = NULL, *entry;
+  struct block_desc *block;
+  u32 start_addr, end_addr, taddr, i;
+  u32 from = ~0, to = 0;
+
+  // ignore cache-through
+  a &= ~0x20000000;
+
+  blist = &inval_lookup[tcache_id][(a & mask) / INVAL_PAGE_SIZE];
+  entry = *blist;
+  while (entry != NULL) {
+    block = entry->block;
+    start_addr = block->addr & ~0x20000000;
+    end_addr = start_addr + block->size;
+    if (start_addr <= a && a < end_addr) {
+      // get addr range that includes all removed blocks
+      if (from > start_addr)
+        from = start_addr;
+      if (to < end_addr)
+        to = end_addr;
+
+      sh2_smc_rm_block(block, tcache_id, mask);
+      if (a >= start_addr + block->size_nolit)
+        literal_disabled_frames = 3;
+
+      // entry lost, restart search
+      entry = *blist;
+      continue;
+    }
+    entry = entry->next;
   }
 
-  if (*p == 0)
+  if (from >= to)
     return;
 
-  tcache_min = tcache_max = sh2_smc_rm_block_entry(&btab[*p >> 1], tcache_id);
-  *p = 0;
+  // update range around a to match latest state
+  from &= ~(INVAL_PAGE_SIZE - 1);
+  to |= (INVAL_PAGE_SIZE - 1);
+  for (taddr = from; taddr < to; taddr += INVAL_PAGE_SIZE) {
+    i = (taddr & mask) / INVAL_PAGE_SIZE;
+    entry = inval_lookup[tcache_id][i];
 
-  for (p++, zeros = 0; p < pmax && zeros < MAX_LITERAL_OFFSET / 2; p++) {
-    int id = *p >> 1;
-    if (id == 0) {
-      // there can be holes because games sometimes keep variables
-      // directly in literal pool and we don't inline them to avoid recompile
-      // (Star Wars Arcade)
-      zeros++;
-      continue;
-    }
-    if (*p & 1) {
-      if (id == (p[1] >> 1))
-        // hit other block
-        break;
-      tcache_max = sh2_smc_rm_block_entry(&btab[id], tcache_id);
+    for (; entry != NULL; entry = entry->next) {
+      block = entry->block;
+
+      start_addr = block->addr & ~0x20000000;
+      if (start_addr > a) {
+        if (to > start_addr)
+          to = start_addr;
+      }
+      else {
+        end_addr = start_addr + block->size;
+        if (from < end_addr)
+          from = end_addr;
+      }
     }
-    *p = 0;
   }
 
-  host_instructions_updated(tcache_min, (void *)((char *)tcache_max + 4*4 + 4));
+  // clear code marks
+  if (from < to) {
+    u16 *p = drc_ram_blk + ((from & mask) >> shift);
+    memset(p, 0, (to - from) >> (shift - 1));
+  }
 }
 
 void sh2_drc_wcheck_ram(unsigned int a, int val, int cpuid)
 {
   dbg(2, "%csh2 smc check @%08x", cpuid ? 's' : 'm', a);
-  sh2_smc_rm_block(a, Pico32xMem->drcblk_ram, 0, SH2_DRCBLK_RAM_SHIFT, 0x3ffff);
+  sh2_smc_rm_blocks(a, Pico32xMem->drcblk_ram, 0, SH2_DRCBLK_RAM_SHIFT, 0x3ffff);
 }
 
 void sh2_drc_wcheck_da(unsigned int a, int val, int cpuid)
 {
   dbg(2, "%csh2 smc check @%08x", cpuid ? 's' : 'm', a);
-  sh2_smc_rm_block(a, Pico32xMem->drcblk_da[cpuid],
+  sh2_smc_rm_blocks(a, Pico32xMem->drcblk_da[cpuid],
     1 + cpuid, SH2_DRCBLK_DA_SHIFT, 0xfff);
 }
 
-void sh2_execute(SH2 *sh2c, int cycles)
+int sh2_execute_drc(SH2 *sh2c, int cycles)
 {
   int ret_cycles;
-  sh2 = sh2c; // XXX
-
-  sh2c->cycles_aim += cycles;
-  cycles = sh2c->cycles_aim - sh2c->cycles_done;
 
   // cycles are kept in SHR_SR unused bits (upper 20)
-  // bit19 contains T saved for delay slot
+  // bit11 contains T saved for delay slot
   // others are usual SH2 flags
   sh2c->sr &= 0x3f3;
   sh2c->sr |= cycles << 12;
@@ -2980,7 +3194,8 @@ void sh2_execute(SH2 *sh2c, int cycles)
   if (ret_cycles > 0)
     dbg(1, "warning: drc returned with cycles: %d", ret_cycles);
 
-  sh2c->cycles_done += cycles - ret_cycles;
+  sh2c->sr &= 0x3f3;
+  return ret_cycles;
 }
 
 #if (DRC_DEBUG & 2)
@@ -2995,7 +3210,7 @@ void block_stats(void)
         total += block_tables[b][i].refcount;
 
   for (c = 0; c < 10; c++) {
-    block_desc *blk, *maxb = NULL;
+    struct block_desc *blk, *maxb = NULL;
     int max = 0;
     for (b = 0; b < ARRAY_SIZE(block_tables); b++) {
       for (i = 0; i < block_counts[b]; i++) {
@@ -3032,12 +3247,18 @@ void sh2_drc_flush_all(void)
 void sh2_drc_mem_setup(SH2 *sh2)
 {
   // fill the convenience pointers
-  sh2->p_bios = sh2->is_slave ? Pico32xMem->sh2_rom_s : Pico32xMem->sh2_rom_m;
-  sh2->p_da = Pico32xMem->data_array[sh2->is_slave];
+  sh2->p_bios = sh2->is_slave ? Pico32xMem->sh2_rom_s.w : Pico32xMem->sh2_rom_m.w;
+  sh2->p_da = sh2->data_array;
   sh2->p_sdram = Pico32xMem->sdram;
   sh2->p_rom = Pico.rom;
 }
 
+void sh2_drc_frame(void)
+{
+  if (literal_disabled_frames > 0)
+    literal_disabled_frames--;
+}
+
 int sh2_drc_init(SH2 *sh2)
 {
   int i;
@@ -3049,12 +3270,22 @@ int sh2_drc_init(SH2 *sh2)
       if (block_tables[i] == NULL)
         goto fail;
       // max 2 block links (exits) per block
-      block_links[i] = calloc(block_max_counts[i] * 2, sizeof(*block_links[0]));
-      if (block_links[i] == NULL)
+      block_link_pool[i] = calloc(block_link_pool_max_counts[i],
+                          sizeof(*block_link_pool[0]));
+      if (block_link_pool[i] == NULL)
+        goto fail;
+
+      inval_lookup[i] = calloc(ram_sizes[i] / INVAL_PAGE_SIZE,
+                               sizeof(inval_lookup[0]));
+      if (inval_lookup[i] == NULL)
+        goto fail;
+
+      hash_tables[i] = calloc(hash_table_sizes[i], sizeof(*hash_tables[0]));
+      if (hash_tables[i] == NULL)
         goto fail;
     }
     memset(block_counts, 0, sizeof(block_counts));
-    memset(block_link_counts, 0, sizeof(block_link_counts));
+    memset(block_link_pool_counts, 0, sizeof(block_link_pool_counts));
 
     drc_cmn_init();
     tcache_ptr = tcache;
@@ -3065,9 +3296,6 @@ int sh2_drc_init(SH2 *sh2)
     for (i = 1; i < ARRAY_SIZE(tcache_bases); i++)
       tcache_bases[i] = tcache_ptrs[i] = tcache_bases[i - 1] + tcache_sizes[i - 1];
 
-    // tmp
-    PicoOpt |= POPT_DIS_VDP_FIFO;
-
 #if (DRC_DEBUG & 4)
     for (i = 0; i < ARRAY_SIZE(block_tables); i++)
       tcache_dsm_ptrs[i] = tcache_bases[i];
@@ -3080,12 +3308,6 @@ int sh2_drc_init(SH2 *sh2)
 #endif
   }
 
-  if (hash_table == NULL) {
-    hash_table = calloc(sizeof(hash_table[0]), MAX_HASH_ENTRIES);
-    if (hash_table == NULL)
-      goto fail;
-  }
-
   return 0;
 
 fail:
@@ -3097,30 +3319,891 @@ void sh2_drc_finish(SH2 *sh2)
 {
   int i;
 
-  if (block_tables[0] != NULL) {
-    block_stats();
+  if (block_tables[0] == NULL)
+    return;
+
+  sh2_drc_flush_all();
 
-    for (i = 0; i < TCACHE_BUFFERS; i++) {
+  for (i = 0; i < TCACHE_BUFFERS; i++) {
 #if (DRC_DEBUG & 4)
-      printf("~~~ tcache %d\n", i);
-      tcache_dsm_ptrs[i] = tcache_bases[i];
-      tcache_ptr = tcache_ptrs[i];
-      do_host_disasm(i);
+    printf("~~~ tcache %d\n", i);
+    tcache_dsm_ptrs[i] = tcache_bases[i];
+    tcache_ptr = tcache_ptrs[i];
+    do_host_disasm(i);
 #endif
 
-      if (block_tables[i] != NULL)
-        free(block_tables[i]);
-      block_tables[i] = NULL;
-      if (block_links[i] == NULL)
-        free(block_links[i]);
-      block_links[i] = NULL;
-    }
+    if (block_tables[i] != NULL)
+      free(block_tables[i]);
+    block_tables[i] = NULL;
+    if (block_link_pool[i] == NULL)
+      free(block_link_pool[i]);
+    block_link_pool[i] = NULL;
 
-    drc_cmn_cleanup();
+    if (inval_lookup[i] == NULL)
+      free(inval_lookup[i]);
+    inval_lookup[i] = NULL;
+
+    if (hash_tables[i] != NULL) {
+      free(hash_tables[i]);
+      hash_tables[i] = NULL;
+    }
+  }
+
+  drc_cmn_cleanup();
+}
+
+#endif /* DRC_SH2 */
+
+static void *dr_get_pc_base(u32 pc, int is_slave)
+{
+  void *ret = NULL;
+  u32 mask = 0;
+
+  if ((pc & ~0x7ff) == 0) {
+    // BIOS
+    ret = is_slave ? Pico32xMem->sh2_rom_s.w : Pico32xMem->sh2_rom_m.w;
+    mask = 0x7ff;
+  }
+  else if ((pc & 0xfffff000) == 0xc0000000) {
+    // data array
+    ret = sh2s[is_slave].data_array;
+    mask = 0xfff;
+  }
+  else if ((pc & 0xc6000000) == 0x06000000) {
+    // SDRAM
+    ret = Pico32xMem->sdram;
+    mask = 0x03ffff;
+  }
+  else if ((pc & 0xc6000000) == 0x02000000) {
+    // ROM
+    if ((pc & 0x3fffff) < Pico.romsize)
+      ret = Pico.rom;
+    mask = 0x3fffff;
+  }
+
+  if (ret == NULL)
+    return (void *)-1; // NULL is valid value
+
+  return (char *)ret - (pc & ~mask);
+}
+
+void scan_block(u32 base_pc, int is_slave, u8 *op_flags, u32 *end_pc_out,
+  u32 *end_literals_out)
+{
+  u16 *dr_pc_base;
+  u32 pc, op, tmp;
+  u32 end_pc, end_literals = 0;
+  u32 lowest_mova = 0;
+  struct op_data *opd;
+  int next_is_delay = 0;
+  int end_block = 0;
+  int i, i_end;
+
+  memset(op_flags, 0, BLOCK_INSN_LIMIT);
+
+  dr_pc_base = dr_get_pc_base(base_pc, is_slave);
+
+  // 1st pass: disassemble
+  for (i = 0, pc = base_pc; ; i++, pc += 2) {
+    // we need an ops[] entry after the last one initialized,
+    // so do it before end_block checks
+    opd = &ops[i];
+    opd->op = OP_UNHANDLED;
+    opd->rm = -1;
+    opd->source = opd->dest = 0;
+    opd->cycles = 1;
+    opd->imm = 0;
+
+    if (next_is_delay) {
+      op_flags[i] |= OF_DELAY_OP;
+      next_is_delay = 0;
+    }
+    else if (end_block || i >= BLOCK_INSN_LIMIT - 2)
+      break;
+
+    op = FETCH_OP(pc);
+    switch ((op & 0xf000) >> 12)
+    {
+    /////////////////////////////////////////////
+    case 0x00:
+      switch (op & 0x0f)
+      {
+      case 0x02:
+        switch (GET_Fx())
+        {
+        case 0: // STC SR,Rn  0000nnnn00000010
+          tmp = SHR_SR;
+          break;
+        case 1: // STC GBR,Rn 0000nnnn00010010
+          tmp = SHR_GBR;
+          break;
+        case 2: // STC VBR,Rn 0000nnnn00100010
+          tmp = SHR_VBR;
+          break;
+        default:
+          goto undefined;
+        }
+        opd->op = OP_MOVE;
+        opd->source = BITMASK1(tmp);
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x03:
+        CHECK_UNHANDLED_BITS(0xd0, undefined);
+        // BRAF Rm    0000mmmm00100011
+        // BSRF Rm    0000mmmm00000011
+        opd->op = OP_BRANCH_RF;
+        opd->rm = GET_Rn();
+        opd->source = BITMASK1(opd->rm);
+        opd->dest = BITMASK1(SHR_PC);
+        if (!(op & 0x20))
+          opd->dest |= BITMASK1(SHR_PR);
+        opd->cycles = 2;
+        next_is_delay = 1;
+        end_block = 1;
+        break;
+      case 0x04: // MOV.B Rm,@(R0,Rn)   0000nnnnmmmm0100
+      case 0x05: // MOV.W Rm,@(R0,Rn)   0000nnnnmmmm0101
+      case 0x06: // MOV.L Rm,@(R0,Rn)   0000nnnnmmmm0110
+        opd->source = BITMASK3(GET_Rm(), SHR_R0, GET_Rn());
+        break;
+      case 0x07:
+        // MUL.L     Rm,Rn      0000nnnnmmmm0111
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(SHR_MACL);
+        opd->cycles = 2;
+        break;
+      case 0x08:
+        CHECK_UNHANDLED_BITS(0xf00, undefined);
+        switch (GET_Fx())
+        {
+        case 0: // CLRT               0000000000001000
+          opd->op = OP_SETCLRT;
+          opd->dest = BITMASK1(SHR_T);
+          opd->imm = 0;
+          break;
+        case 1: // SETT               0000000000011000
+          opd->op = OP_SETCLRT;
+          opd->dest = BITMASK1(SHR_T);
+          opd->imm = 1;
+          break;
+        case 2: // CLRMAC             0000000000101000
+          opd->dest = BITMASK3(SHR_T, SHR_MACL, SHR_MACH);
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x09:
+        switch (GET_Fx())
+        {
+        case 0: // NOP        0000000000001001
+          CHECK_UNHANDLED_BITS(0xf00, undefined);
+          break;
+        case 1: // DIV0U      0000000000011001
+          CHECK_UNHANDLED_BITS(0xf00, undefined);
+          opd->dest = BITMASK2(SHR_SR, SHR_T);
+          break;
+        case 2: // MOVT Rn    0000nnnn00101001
+          opd->source = BITMASK1(SHR_T);
+          opd->dest = BITMASK1(GET_Rn());
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x0a:
+        switch (GET_Fx())
+        {
+        case 0: // STS      MACH,Rn   0000nnnn00001010
+          tmp = SHR_MACH;
+          break;
+        case 1: // STS      MACL,Rn   0000nnnn00011010
+          tmp = SHR_MACL;
+          break;
+        case 2: // STS      PR,Rn     0000nnnn00101010
+          tmp = SHR_PR;
+          break;
+        default:
+          goto undefined;
+        }
+        opd->op = OP_MOVE;
+        opd->source = BITMASK1(tmp);
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x0b:
+        CHECK_UNHANDLED_BITS(0xf00, undefined);
+        switch (GET_Fx())
+        {
+        case 0: // RTS        0000000000001011
+          opd->op = OP_BRANCH_R;
+          opd->rm = SHR_PR;
+          opd->source = BITMASK1(opd->rm);
+          opd->dest = BITMASK1(SHR_PC);
+          opd->cycles = 2;
+          next_is_delay = 1;
+          end_block = 1;
+          break;
+        case 1: // SLEEP      0000000000011011
+          opd->op = OP_SLEEP;
+          end_block = 1;
+          break;
+        case 2: // RTE        0000000000101011
+          opd->op = OP_RTE;
+          opd->source = BITMASK1(SHR_SP);
+          opd->dest = BITMASK2(SHR_SR, SHR_PC);
+          opd->cycles = 4;
+          next_is_delay = 1;
+          end_block = 1;
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x0c: // MOV.B    @(R0,Rm),Rn      0000nnnnmmmm1100
+      case 0x0d: // MOV.W    @(R0,Rm),Rn      0000nnnnmmmm1101
+      case 0x0e: // MOV.L    @(R0,Rm),Rn      0000nnnnmmmm1110
+        opd->source = BITMASK2(GET_Rm(), SHR_R0);
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x0f: // MAC.L   @Rm+,@Rn+  0000nnnnmmmm1111
+        opd->source = BITMASK5(GET_Rm(), GET_Rn(), SHR_SR, SHR_MACL, SHR_MACH);
+        opd->dest = BITMASK4(GET_Rm(), GET_Rn(), SHR_MACL, SHR_MACH);
+        opd->cycles = 3;
+        break;
+      default:
+        goto undefined;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x01:
+      // MOV.L Rm,@(disp,Rn) 0001nnnnmmmmdddd
+      opd->source = BITMASK1(GET_Rm());
+      opd->source = BITMASK1(GET_Rn());
+      opd->imm = (op & 0x0f) * 4;
+      break;
+
+    /////////////////////////////////////////////
+    case 0x02:
+      switch (op & 0x0f)
+      {
+      case 0x00: // MOV.B Rm,@Rn        0010nnnnmmmm0000
+      case 0x01: // MOV.W Rm,@Rn        0010nnnnmmmm0001
+      case 0x02: // MOV.L Rm,@Rn        0010nnnnmmmm0010
+        opd->source = BITMASK1(GET_Rm());
+        opd->source = BITMASK1(GET_Rn());
+        break;
+      case 0x04: // MOV.B Rm,@-Rn       0010nnnnmmmm0100
+      case 0x05: // MOV.W Rm,@-Rn       0010nnnnmmmm0101
+      case 0x06: // MOV.L Rm,@-Rn       0010nnnnmmmm0110
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x07: // DIV0S Rm,Rn         0010nnnnmmmm0111
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(SHR_SR);
+        break;
+      case 0x08: // TST Rm,Rn           0010nnnnmmmm1000
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(SHR_T);
+        break;
+      case 0x09: // AND Rm,Rn           0010nnnnmmmm1001
+      case 0x0a: // XOR Rm,Rn           0010nnnnmmmm1010
+      case 0x0b: // OR  Rm,Rn           0010nnnnmmmm1011
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x0c: // CMP/STR Rm,Rn       0010nnnnmmmm1100
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(SHR_T);
+        break;
+      case 0x0d: // XTRCT  Rm,Rn        0010nnnnmmmm1101
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x0e: // MULU.W Rm,Rn        0010nnnnmmmm1110
+      case 0x0f: // MULS.W Rm,Rn        0010nnnnmmmm1111
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(SHR_MACL);
+        break;
+      default:
+        goto undefined;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x03:
+      switch (op & 0x0f)
+      {
+      case 0x00: // CMP/EQ Rm,Rn        0011nnnnmmmm0000
+      case 0x02: // CMP/HS Rm,Rn        0011nnnnmmmm0010
+      case 0x03: // CMP/GE Rm,Rn        0011nnnnmmmm0011
+      case 0x06: // CMP/HI Rm,Rn        0011nnnnmmmm0110
+      case 0x07: // CMP/GT Rm,Rn        0011nnnnmmmm0111
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(SHR_T);
+        break;
+      case 0x04: // DIV1    Rm,Rn       0011nnnnmmmm0100
+        opd->source = BITMASK3(GET_Rm(), GET_Rn(), SHR_SR);
+        opd->dest = BITMASK2(GET_Rn(), SHR_SR);
+        break;
+      case 0x05: // DMULU.L Rm,Rn       0011nnnnmmmm0101
+      case 0x0d: // DMULS.L Rm,Rn       0011nnnnmmmm1101
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK2(SHR_MACL, SHR_MACH);
+        opd->cycles = 2;
+        break;
+      case 0x08: // SUB     Rm,Rn       0011nnnnmmmm1000
+      case 0x0c: // ADD     Rm,Rn       0011nnnnmmmm1100
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x0a: // SUBC    Rm,Rn       0011nnnnmmmm1010
+      case 0x0e: // ADDC    Rm,Rn       0011nnnnmmmm1110
+        opd->source = BITMASK3(GET_Rm(), GET_Rn(), SHR_T);
+        opd->dest = BITMASK2(GET_Rn(), SHR_T);
+        break;
+      case 0x0b: // SUBV    Rm,Rn       0011nnnnmmmm1011
+      case 0x0f: // ADDV    Rm,Rn       0011nnnnmmmm1111
+        opd->source = BITMASK2(GET_Rm(), GET_Rn());
+        opd->dest = BITMASK2(GET_Rn(), SHR_T);
+        break;
+      default:
+        goto undefined;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x04:
+      switch (op & 0x0f)
+      {
+      case 0x00:
+        switch (GET_Fx())
+        {
+        case 0: // SHLL Rn    0100nnnn00000000
+        case 2: // SHAL Rn    0100nnnn00100000
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK2(GET_Rn(), SHR_T);
+          break;
+        case 1: // DT Rn      0100nnnn00010000
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK2(GET_Rn(), SHR_T);
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x01:
+        switch (GET_Fx())
+        {
+        case 0: // SHLR Rn    0100nnnn00000001
+        case 2: // SHAR Rn    0100nnnn00100001
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK2(GET_Rn(), SHR_T);
+          break;
+        case 1: // CMP/PZ Rn  0100nnnn00010001
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK1(SHR_T);
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x02:
+      case 0x03:
+        switch (op & 0x3f)
+        {
+        case 0x02: // STS.L    MACH,@-Rn 0100nnnn00000010
+          tmp = SHR_MACH;
+          break;
+        case 0x12: // STS.L    MACL,@-Rn 0100nnnn00010010
+          tmp = SHR_MACL;
+          break;
+        case 0x22: // STS.L    PR,@-Rn   0100nnnn00100010
+          tmp = SHR_PR;
+          break;
+        case 0x03: // STC.L    SR,@-Rn   0100nnnn00000011
+          tmp = SHR_SR;
+          opd->cycles = 2;
+          break;
+        case 0x13: // STC.L    GBR,@-Rn  0100nnnn00010011
+          tmp = SHR_GBR;
+          opd->cycles = 2;
+          break;
+        case 0x23: // STC.L    VBR,@-Rn  0100nnnn00100011
+          tmp = SHR_VBR;
+          opd->cycles = 2;
+          break;
+        default:
+          goto undefined;
+        }
+        opd->source = BITMASK2(GET_Rn(), tmp);
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x04:
+      case 0x05:
+        switch (op & 0x3f)
+        {
+        case 0x04: // ROTL   Rn          0100nnnn00000100
+        case 0x05: // ROTR   Rn          0100nnnn00000101
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK2(GET_Rn(), SHR_T);
+          break;
+        case 0x24: // ROTCL  Rn          0100nnnn00100100
+        case 0x25: // ROTCR  Rn          0100nnnn00100101
+          opd->source = BITMASK2(GET_Rn(), SHR_T);
+          opd->dest = BITMASK2(GET_Rn(), SHR_T);
+          break;
+        case 0x15: // CMP/PL Rn          0100nnnn00010101
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK1(SHR_T);
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x06:
+      case 0x07:
+        switch (op & 0x3f)
+        {
+        case 0x06: // LDS.L @Rm+,MACH 0100mmmm00000110
+          tmp = SHR_MACH;
+          break;
+        case 0x16: // LDS.L @Rm+,MACL 0100mmmm00010110
+          tmp = SHR_MACL;
+          break;
+        case 0x26: // LDS.L @Rm+,PR   0100mmmm00100110
+          tmp = SHR_PR;
+          break;
+        case 0x07: // LDC.L @Rm+,SR   0100mmmm00000111
+          tmp = SHR_SR;
+          opd->cycles = 3;
+          break;
+        case 0x17: // LDC.L @Rm+,GBR  0100mmmm00010111
+          tmp = SHR_GBR;
+          opd->cycles = 3;
+          break;
+        case 0x27: // LDC.L @Rm+,VBR  0100mmmm00100111
+          tmp = SHR_VBR;
+          opd->cycles = 3;
+          break;
+        default:
+          goto undefined;
+        }
+        opd->source = BITMASK1(GET_Rn());
+        opd->dest = BITMASK2(GET_Rn(), tmp);
+        break;
+      case 0x08:
+      case 0x09:
+        switch (GET_Fx())
+        {
+        case 0:
+          // SHLL2 Rn        0100nnnn00001000
+          // SHLR2 Rn        0100nnnn00001001
+          break;
+        case 1:
+          // SHLL8 Rn        0100nnnn00011000
+          // SHLR8 Rn        0100nnnn00011001
+          break;
+        case 2:
+          // SHLL16 Rn       0100nnnn00101000
+          // SHLR16 Rn       0100nnnn00101001
+          break;
+        default:
+          goto undefined;
+        }
+        opd->source = BITMASK1(GET_Rn());
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      case 0x0a:
+        switch (GET_Fx())
+        {
+        case 0: // LDS      Rm,MACH   0100mmmm00001010
+          tmp = SHR_MACH;
+          break;
+        case 1: // LDS      Rm,MACL   0100mmmm00011010
+          tmp = SHR_MACL;
+          break;
+        case 2: // LDS      Rm,PR     0100mmmm00101010
+          tmp = SHR_PR;
+          break;
+        default:
+          goto undefined;
+        }
+        opd->op = OP_MOVE;
+        opd->source = BITMASK1(GET_Rn());
+        opd->dest = BITMASK1(tmp);
+        break;
+      case 0x0b:
+        switch (GET_Fx())
+        {
+        case 0: // JSR  @Rm   0100mmmm00001011
+          opd->dest = BITMASK1(SHR_PR);
+        case 2: // JMP  @Rm   0100mmmm00101011
+          opd->op = OP_BRANCH_R;
+          opd->rm = GET_Rn();
+          opd->source = BITMASK1(opd->rm);
+          opd->dest |= BITMASK1(SHR_PC);
+          opd->cycles = 2;
+          next_is_delay = 1;
+          end_block = 1;
+          break;
+        case 1: // TAS.B @Rn  0100nnnn00011011
+          opd->source = BITMASK1(GET_Rn());
+          opd->dest = BITMASK1(SHR_T);
+          opd->cycles = 4;
+          break;
+        default:
+          goto undefined;
+        }
+        break;
+      case 0x0e:
+        switch (GET_Fx())
+        {
+        case 0: // LDC Rm,SR   0100mmmm00001110
+          tmp = SHR_SR;
+          break;
+        case 1: // LDC Rm,GBR  0100mmmm00011110
+          tmp = SHR_GBR;
+          break;
+        case 2: // LDC Rm,VBR  0100mmmm00101110
+          tmp = SHR_VBR;
+          break;
+        default:
+          goto undefined;
+        }
+        opd->op = OP_MOVE;
+        opd->source = BITMASK1(GET_Rn());
+        opd->dest = BITMASK1(tmp);
+        break;
+      case 0x0f:
+        // MAC.W @Rm+,@Rn+  0100nnnnmmmm1111
+        opd->source = BITMASK5(GET_Rm(), GET_Rn(), SHR_SR, SHR_MACL, SHR_MACH);
+        opd->dest = BITMASK4(GET_Rm(), GET_Rn(), SHR_MACL, SHR_MACH);
+        opd->cycles = 3;
+        break;
+      default:
+        goto undefined;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x05:
+      // MOV.L @(disp,Rm),Rn 0101nnnnmmmmdddd
+      opd->source = BITMASK1(GET_Rm());
+      opd->dest = BITMASK1(GET_Rn());
+      opd->imm = (op & 0x0f) * 4;
+      break;
+
+    /////////////////////////////////////////////
+    case 0x06:
+      switch (op & 0x0f)
+      {
+      case 0x04: // MOV.B @Rm+,Rn       0110nnnnmmmm0100
+      case 0x05: // MOV.W @Rm+,Rn       0110nnnnmmmm0101
+      case 0x06: // MOV.L @Rm+,Rn       0110nnnnmmmm0110
+        opd->dest = BITMASK1(GET_Rm());
+      case 0x00: // MOV.B @Rm,Rn        0110nnnnmmmm0000
+      case 0x01: // MOV.W @Rm,Rn        0110nnnnmmmm0001
+      case 0x02: // MOV.L @Rm,Rn        0110nnnnmmmm0010
+        opd->source = BITMASK1(GET_Rm());
+        opd->dest |= BITMASK1(GET_Rn());
+        break;
+      case 0x0a: // NEGC   Rm,Rn        0110nnnnmmmm1010
+        opd->source = BITMASK2(GET_Rm(), SHR_T);
+        opd->dest = BITMASK2(GET_Rn(), SHR_T);
+        break;
+      case 0x03: // MOV    Rm,Rn        0110nnnnmmmm0011
+        opd->op = OP_MOVE;
+        goto arith_rmrn;
+      case 0x07: // NOT    Rm,Rn        0110nnnnmmmm0111
+      case 0x08: // SWAP.B Rm,Rn        0110nnnnmmmm1000
+      case 0x09: // SWAP.W Rm,Rn        0110nnnnmmmm1001
+      case 0x0b: // NEG    Rm,Rn        0110nnnnmmmm1011
+      case 0x0c: // EXTU.B Rm,Rn        0110nnnnmmmm1100
+      case 0x0d: // EXTU.W Rm,Rn        0110nnnnmmmm1101
+      case 0x0e: // EXTS.B Rm,Rn        0110nnnnmmmm1110
+      case 0x0f: // EXTS.W Rm,Rn        0110nnnnmmmm1111
+      arith_rmrn:
+        opd->source = BITMASK1(GET_Rm());
+        opd->dest = BITMASK1(GET_Rn());
+        break;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x07:
+      // ADD #imm,Rn  0111nnnniiiiiiii
+      opd->source = opd->dest = BITMASK1(GET_Rn());
+      opd->imm = (int)(signed char)op;
+      break;
+
+    /////////////////////////////////////////////
+    case 0x08:
+      switch (op & 0x0f00)
+      {
+      case 0x0000: // MOV.B R0,@(disp,Rn)  10000000nnnndddd
+        opd->source = BITMASK2(GET_Rm(), SHR_R0);
+        opd->imm = (op & 0x0f);
+        break;
+      case 0x0100: // MOV.W R0,@(disp,Rn)  10000001nnnndddd
+        opd->source = BITMASK2(GET_Rm(), SHR_R0);
+        opd->imm = (op & 0x0f) * 2;
+        break;
+      case 0x0400: // MOV.B @(disp,Rm),R0  10000100mmmmdddd
+        opd->source = BITMASK1(GET_Rm());
+        opd->dest = BITMASK1(SHR_R0);
+        opd->imm = (op & 0x0f);
+        break;
+      case 0x0500: // MOV.W @(disp,Rm),R0  10000101mmmmdddd
+        opd->source = BITMASK1(GET_Rm());
+        opd->dest = BITMASK1(SHR_R0);
+        opd->imm = (op & 0x0f) * 2;
+        break;
+      case 0x0800: // CMP/EQ #imm,R0       10001000iiiiiiii
+        opd->source = BITMASK1(SHR_R0);
+        opd->dest = BITMASK1(SHR_T);
+        opd->imm = (int)(signed char)op;
+        break;
+      case 0x0d00: // BT/S label 10001101dddddddd
+      case 0x0f00: // BF/S label 10001111dddddddd
+        next_is_delay = 1;
+        // fallthrough
+      case 0x0900: // BT   label 10001001dddddddd
+      case 0x0b00: // BF   label 10001011dddddddd
+        opd->op = (op & 0x0200) ? OP_BRANCH_CF : OP_BRANCH_CT;
+        opd->source = BITMASK1(SHR_T);
+        opd->dest = BITMASK1(SHR_PC);
+        opd->imm = ((signed int)(op << 24) >> 23);
+        opd->imm += pc + 4;
+        if (base_pc <= opd->imm && opd->imm < base_pc + BLOCK_INSN_LIMIT * 2)
+          op_flags[(opd->imm - base_pc) / 2] |= OF_BTARGET;
+        break;
+      default:
+        goto undefined;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x09:
+      // MOV.W @(disp,PC),Rn  1001nnnndddddddd
+      opd->op = OP_LOAD_POOL;
+      tmp = pc + 2;
+      if (op_flags[i] & OF_DELAY_OP) {
+        if (ops[i-1].op == OP_BRANCH)
+          tmp = ops[i-1].imm;
+        else
+          tmp = 0;
+      }
+      opd->source = BITMASK1(SHR_PC);
+      opd->dest = BITMASK1(GET_Rn());
+      if (tmp)
+        opd->imm = tmp + 2 + (op & 0xff) * 2;
+      opd->size = 1;
+      break;
+
+    /////////////////////////////////////////////
+    case 0x0b:
+      // BSR  label 1011dddddddddddd
+      opd->dest = BITMASK1(SHR_PR);
+    case 0x0a:
+      // BRA  label 1010dddddddddddd
+      opd->op = OP_BRANCH;
+      opd->dest |= BITMASK1(SHR_PC);
+      opd->imm = ((signed int)(op << 20) >> 19);
+      opd->imm += pc + 4;
+      opd->cycles = 2;
+      next_is_delay = 1;
+      end_block = 1;
+      if (base_pc <= opd->imm && opd->imm < base_pc + BLOCK_INSN_LIMIT * 2)
+        op_flags[(opd->imm - base_pc) / 2] |= OF_BTARGET;
+      break;
+
+    /////////////////////////////////////////////
+    case 0x0c:
+      switch (op & 0x0f00)
+      {
+      case 0x0000: // MOV.B R0,@(disp,GBR)   11000000dddddddd
+      case 0x0100: // MOV.W R0,@(disp,GBR)   11000001dddddddd
+      case 0x0200: // MOV.L R0,@(disp,GBR)   11000010dddddddd
+        opd->source = BITMASK2(SHR_GBR, SHR_R0);
+        opd->size = (op & 0x300) >> 8;
+        opd->imm = (op & 0xff) << opd->size;
+        break;
+      case 0x0400: // MOV.B @(disp,GBR),R0   11000100dddddddd
+      case 0x0500: // MOV.W @(disp,GBR),R0   11000101dddddddd
+      case 0x0600: // MOV.L @(disp,GBR),R0   11000110dddddddd
+        opd->source = BITMASK1(SHR_GBR);
+        opd->dest = BITMASK1(SHR_R0);
+        opd->size = (op & 0x300) >> 8;
+        opd->imm = (op & 0xff) << opd->size;
+        break;
+      case 0x0300: // TRAPA #imm      11000011iiiiiiii
+        opd->source = BITMASK2(SHR_PC, SHR_SR);
+        opd->dest = BITMASK1(SHR_PC);
+        opd->imm = (op & 0xff) * 4;
+        opd->cycles = 8;
+        end_block = 1; // FIXME
+        break;
+      case 0x0700: // MOVA @(disp,PC),R0    11000111dddddddd
+        opd->op = OP_MOVA;
+        tmp = pc + 2;
+        if (op_flags[i] & OF_DELAY_OP) {
+          if (ops[i-1].op == OP_BRANCH)
+            tmp = ops[i-1].imm;
+          else
+            tmp = 0;
+        }
+        opd->dest = BITMASK1(SHR_R0);
+        if (tmp) {
+          opd->imm = (tmp + 2 + (op & 0xff) * 4) & ~3;
+          if (opd->imm >= base_pc) {
+            if (lowest_mova == 0 || opd->imm < lowest_mova)
+              lowest_mova = opd->imm;
+          }
+        }
+        break;
+      case 0x0800: // TST #imm,R0           11001000iiiiiiii
+        opd->source = BITMASK1(SHR_R0);
+        opd->dest = BITMASK1(SHR_T);
+        opd->imm = op & 0xff;
+        break;
+      case 0x0900: // AND #imm,R0           11001001iiiiiiii
+        opd->source = opd->dest = BITMASK1(SHR_R0);
+        opd->imm = op & 0xff;
+        break;
+      case 0x0a00: // XOR #imm,R0           11001010iiiiiiii
+        opd->source = opd->dest = BITMASK1(SHR_R0);
+        opd->imm = op & 0xff;
+        break;
+      case 0x0b00: // OR  #imm,R0           11001011iiiiiiii
+        opd->source = opd->dest = BITMASK1(SHR_R0);
+        opd->imm = op & 0xff;
+        break;
+      case 0x0c00: // TST.B #imm,@(R0,GBR)  11001100iiiiiiii
+        opd->source = BITMASK2(SHR_GBR, SHR_R0);
+        opd->dest = BITMASK1(SHR_T);
+        opd->imm = op & 0xff;
+        opd->cycles = 3;
+        break;
+      case 0x0d00: // AND.B #imm,@(R0,GBR)  11001101iiiiiiii
+      case 0x0e00: // XOR.B #imm,@(R0,GBR)  11001110iiiiiiii
+      case 0x0f00: // OR.B  #imm,@(R0,GBR)  11001111iiiiiiii
+        opd->source = BITMASK2(SHR_GBR, SHR_R0);
+        opd->imm = op & 0xff;
+        opd->cycles = 3;
+        break;
+      default:
+        goto undefined;
+      }
+      break;
+
+    /////////////////////////////////////////////
+    case 0x0d:
+      // MOV.L @(disp,PC),Rn  1101nnnndddddddd
+      opd->op = OP_LOAD_POOL;
+      tmp = pc + 2;
+      if (op_flags[i] & OF_DELAY_OP) {
+        if (ops[i-1].op == OP_BRANCH)
+          tmp = ops[i-1].imm;
+        else
+          tmp = 0;
+      }
+      opd->source = BITMASK1(SHR_PC);
+      opd->dest = BITMASK1(GET_Rn());
+      if (tmp)
+        opd->imm = (tmp + 2 + (op & 0xff) * 4) & ~3;
+      opd->size = 2;
+      break;
+
+    /////////////////////////////////////////////
+    case 0x0e:
+      // MOV #imm,Rn   1110nnnniiiiiiii
+      opd->dest = BITMASK1(GET_Rn());
+      opd->imm = (u32)(signed int)(signed char)op;
+      break;
+
+    default:
+    undefined:
+      elprintf(EL_ANOMALY, "%csh2 drc: unhandled op %04x @ %08x",
+        is_slave ? 's' : 'm', op, pc);
+      break;
+    }
+
+    if (op_flags[i] & OF_DELAY_OP) {
+      switch (opd->op) {
+      case OP_BRANCH:
+      case OP_BRANCH_CT:
+      case OP_BRANCH_CF:
+      case OP_BRANCH_R:
+      case OP_BRANCH_RF:
+        elprintf(EL_ANOMALY, "%csh2 drc: branch in DS @ %08x",
+          is_slave ? 's' : 'm', pc);
+        opd->op = OP_UNHANDLED;
+        op_flags[i] |= OF_B_IN_DS;
+        next_is_delay = 0;
+        break;
+      }
+    }
   }
+  i_end = i;
+  end_pc = pc;
+
+  // 2nd pass: some analysis
+  for (i = 0; i < i_end; i++) {
+    opd = &ops[i];
 
-  if (hash_table != NULL) {
-    free(hash_table);
-    hash_table = NULL;
+    // propagate T (TODO: DIV0U)
+    if ((opd->op == OP_SETCLRT && !opd->imm) || opd->op == OP_BRANCH_CT)
+      op_flags[i + 1] |= OF_T_CLEAR;
+    else if ((opd->op == OP_SETCLRT && opd->imm) || opd->op == OP_BRANCH_CF)
+      op_flags[i + 1] |= OF_T_SET;
+
+    if ((op_flags[i] & OF_BTARGET) || (opd->dest & BITMASK1(SHR_T)))
+      op_flags[i] &= ~(OF_T_SET | OF_T_CLEAR);
+    else
+      op_flags[i + 1] |= op_flags[i] & (OF_T_SET | OF_T_CLEAR);
+
+    if ((opd->op == OP_BRANCH_CT && (op_flags[i] & OF_T_SET))
+        || (opd->op == OP_BRANCH_CF && (op_flags[i] & OF_T_CLEAR)))
+    {
+      opd->op = OP_BRANCH;
+      opd->cycles = 3;
+      i_end = i + 1;
+      if (op_flags[i + 1] & OF_DELAY_OP) {
+        opd->cycles = 2;
+        i_end++;
+      }
+    }
+    else if (opd->op == OP_LOAD_POOL)
+    {
+      if (opd->imm < end_pc + MAX_LITERAL_OFFSET) {
+        if (end_literals < opd->imm + opd->size * 2)
+          end_literals = opd->imm + opd->size * 2;
+      }
+    }
   }
+  end_pc = base_pc + i_end * 2;
+  if (end_literals < end_pc)
+    end_literals = end_pc;
+
+  // end_literals is used to decide to inline a literal or not
+  // XXX: need better detection if this actually is used in write
+  if (lowest_mova >= base_pc) {
+    if (lowest_mova < end_literals) {
+      dbg(1, "mova for %08x, block %08x", lowest_mova, base_pc);
+      end_literals = end_pc;
+    }
+    if (lowest_mova < end_pc) {
+      dbg(1, "warning: mova inside of blk for %08x, block %08x",
+        lowest_mova, base_pc);
+      end_literals = end_pc;
+    }
+  }
+
+  *end_pc_out = end_pc;
+  if (end_literals_out != NULL)
+    *end_literals_out = end_literals;
 }
+
+// vim:shiftwidth=2:ts=2:expandtab